Defining actions and headers

Defining actions and headers

After checking message contents, the filter assigns a global score to the message. ze-filter can take different actions depending on the global score assigned to the message or to scores assigned by each kind of check.

Possible actions (with their official names) are :

QUARANTINE
REJECT
HEADER_HI
HEADER_LO
HEADER_UNSURE
HEADER_HAM

Actions and their conditions are defined, at ze-filter configuration file, by rules :

XSTATUS_xxx_CONDITION                condition; condition; ...

where xxx is one possible action, as defined above. Actions are checked in the same order defined above. After a condition matches, the filter stops looking for other possible actions.

Each condition is of the form :

parameter     operator    value

parameter is one of :

score - global score
bayes - naive bayes filter score
urlbl - URL filtering score
regex - pattern matching score
urlbl+regex or regex+urlbl - trivial, it seems…
oracle - heuristic filter score
header - just added X-ze-filter-Score header

An example of condition is :

XSTATUS_REJECT_CONDITION     score > 0.75; urlbl > 19; header ~ R=##.*U=####

This means : the message will be rejected :

if global score is greater than 0.75
OR
if the URLBL score is greater than 19
OR
if the just added X-ze-filter-Score header matches R=##.*U=#### regular expression

Adding/changing headers

To define which header will be added or changed :

XSTATUS_HEADER                     X-ze-filter-Status

Default ze-filter status header is X-ze-filter-Status. Some other filters use something different, e.g. X-Spam-Status or X-Spam-Flag. MUAs like thunderbird can integrate some of these headers in their filtering. This is, probably, the easiest way to integrate ze-filter results into the MUA filtering.

# Adds - X-ze-filter-Status: Spam HI
XSTATUS_HEADER_HI_CONDITION        score > 0.75
# Adds - X-ze-filter-Status: Spam LO
XSTATUS_HEADER_LO_CONDITION        score > 0.5
# Adds - X-ze-filter-Status: Unsure
XSTATUS_HEADER_UNSURE_CONDITION    score > 0.25
# Adds - X-ze-filter-Status: Ham
XSTATUS_HEADER_HAM_CONDITION       score < 0.25

Changing Message Subject

You should avoid changing message subject but, unfortunately, you may want/need this feature.

To enable/disable this feature, use the SCORE_ON_SUBJECT configuration option.

SCORE_ON_SUBJECT                   YES
SCORE_ON_SUBJECT_TAG               ***SPAM***

SCORE_ON_SUBJECT_TAG defines a string to be prepended to Subject header. If you don't define this, ze-filter will add a string of the form [J-XXX], where the number of X is proportional to message global score.

Rejecting the message during SMTP session

XSTATUS_REJECT_CONDITION           bayes > 3.8; urlbl > 89

Discarding and quarantining

XSTATUS_QUARANTINE_CONDITION       bayes > 0.8; urlbl > 19; (U=######|B=0.9|B=0.8|XXXX.*B=0.7)

More info about quarantine management

Preserving or removing old score headers

Sometimes you may want to remove previously added ze-filter headers and let only those added by your mail server or some known mail servers. You can do this with the PRESERVE_OLD_SCORES.

PRESERVE_OLD_SCORES                ALL

There are three possible situations :

Preserve all headers - This is the default value, and is enabled if the value of this option is ALL or an empty string.

Remove all previous ze-filter headers - To enable this behaviour, set PRESERVE_OLD_HEADERS to NONE

Preserve only headers added by some list of mailservers - Define the list of mailservers, separated by a space or a comma :

PRESERVE_OLD_SCORES       smtp.example.com, mail.domain.com