Saturday, April 03, 2010

spamassassin "date grossly in the future"

I use spamassassin with my mail server. For a couple of months now, I have seen an excess number of false positives. The reason Spamassassin considers those messages as spam is "date is grossly in the future". I use ntp, so the date is correct. I do have the threshold for marking a message as spam rather low, viz. 3.0, where 5.0 is the default. So far, 3.0 has worked well for me.

After some googling I found that the Spamassassin rule that checks if the date is in the future, uses the regex 20[0-9][0-9]. This sets any date in 2010 as a date "grossly in the future". Now, the release of Spamassassin that I have, has 20[2-9][0-9], which is correct. So why does my Spamassassin use the old rule? I set the threshold to 5.0, but the messages still said "3.0". I restarted Spamassassin a few times, I even restarted Postfix, to no avail. Until I realized that I use Spampd as a daemon to run Spamassassin, and maybe Spamassassin only reloads its local.cf at a Spampd restart. Which turned out to be the case: restarting Spampd solved the issue. I'll set the threshold back to 3.0 and I won't have false positives any more because of "date grossly in the future".

The problem with running your own mail and web server on linux is that it requires so little maintenance. By the time it requires attention, it's been a year or so that you've made the last change, so you don't remember the details. I have to document everything I do because I know that next time I look into it, I won't remember.

No comments: