Richard
I have chosen to train DSPAM by moving the spam messages that I receive into a Junk folder in my mail client. I’ve made a small script that checks all Junk folders on the server and feeds them to DSPAM as false negatives to learn DSPAM what spam looks like. This is currently the easiest way to train DSPAM without having to rely on the web based GUI. Please note that this only works if you use IMAP folders, if your users use POP3 we have to look at another solution.
The script looks into the database of postfixadmin to see which users are defined on your system and where their mail directory is located. It then feeds every single message to DSPAM indicating it as an error and to correct DSPAM’s behaviour. After the message is processed the it is removed from the folder.
You can select which IMAP folder your want to use for storing all your SPAM including false negatives (uncaught spam) by changing this entry in the script (don’t forget the leading .):
You can define the folder where it should get the false positives (email wrongly identified as spam) in this variable (don’t forget the leading .):
Configure your postfixadmin database settings with these entries in the script:
DBPASS=yourpassword
DB=postfix
If you want the script not to delete the identified SPAM when the email has been processed then change the DELETESPAM option in something else than YES, like NO:
The same rule is valid for the NotSpam folder. To not delete the email from the folder for false positives set this variable to NO.
If you copy the script into /etc/periodic/daily and make it executable it will run once a day and learn each users spam.
You can download my script train.dspam here
Please note that DSPAM won’t catch spam at first, you’ll need to train it first. The longer you train it the better it will get. You can use your email client junk mail controls to train DSPAM. Configure your mail client to move emails it identifies into the Junk folder. See the screenshots below on how to configure Mail.app and Thunderbird to do this.

Mail.app

Thunderbird



Comments
12:33 am
Hi Richard,
When I run the train.dspam script I get a whole slew of these errors:
Mar 5 14:14:12 mail dspam[5451]: Unable to find a valid signature. Aborting.
Mar 5 14:14:12 mail dspam[5451]: process_message returned error -5. dropping message.
The dspam man page says feeding dspam with –source=error will reject the message if it doesn’t have a signature. The mail in .Junk has been manually moved in there so it doesn’t have any X-Dspam headers.
I changed the lines to –source=corpus and got a bunch of these instead:
Mar 5 15:15:34 mail dspam[8640]: query error: VERBOSE DEBUG (INFO ONLY – NOT AN ERROR): see sql.errors for more details
Is this just normal verbose debug output? I don’t see any query errors in /usr/local/var/dspam/log/sql.errors.
4:55 pm
Yes the output is correct, VERBOSE DEBUG is the line it shows every time DSPAM has done something.
But your incoming email must have the dspam headers, otherwise the training does not work properly. Make sure the config file reflects that. Only learning from the corpus works but it isn’t the optimal solution.
7:49 pm
Hi Richard,
Just wanted to say thank you very much for the site and the dspam how-to.
Stevan from the dspam list suggested I make several changes to the dspam configuration, so I thought I’d pass them along to you.
TrainingMode TOE (default is TEFT)
Tokenizer osb (default is chain)
MySQLCompress false (default is true)
ServerParameters “–deliver=innocent,spam” (remove the space after the comma)
8:29 pm
@Terry, thanks for mentioning this. I will test this and update the config as soon as possible.
8:26 pm
Hi Richard,
How long did it take for your DSPAM install to begin tagging email as spam? I’ve been running it for approximately 4 weeks and according to dspam_stats, none of my 20 users have any True Positives or False Positives. There are two users who have 0 Training Left (I’m one of them) and all users have some number of both True Negatives and False Negatives. I’ve checked the logs and it appears to be working, but just not identifying messages as spam. Any ideas?
Thanks,
-Terry
7:28 am
@Terry, after a week or so. Maybe tagging isn’t working because of a configuration error. You could also check the DSpam header “X-Dspam-Result” in your emails. It should give you a good indication.
7:25 pm
Thanks Richard. I’m sure there’s some sort of configuration problem going on, but I haven’t found it yet. Looking at about 50 recent headers:
X-Dspam-Result: is always Innocent or Whitelisted
X-Dspam-Confidence: is between 0.998x – 0.999x
X-Dspam-Probability: is always -1.0000
It’s almost like I’m missing a switch to enable spam detection.