SpamAssassin

Preface

If you use email, it’s likely that you’ve recently been visited by a piece of spam—an unsolicited, unwanted message, sent to you without your permission.^[1] If you manage an email system, it’s almost certain that you’ve had to help your users avoid the deluge of unwanted email.

System administrators pay for spam with their time. The Internet’s email system was designed to make it difficult to lose email messages: when a computer can’t deliver a message to the intended recipient, it does its best to return that message to the sender. If it can’t send the message to the sender, it sends it to the computer’s postmaster—because something must be seriously wrong if both the email addresses of the sender and the recipient of a message are invalid.

The well-meaning nature of Internet mail software becomes a positive liability when spammers come into the picture. In a typical bulk mailing, anywhere from a few hundred to tens of thousands of email addresses might be invalid. Under normal circumstances these email messages would bounce back to the sender. But the spammer doesn’t want them! To avoid being overwhelmed, spammers often use invalid return addresses. The result: the email messages end up in the mailboxes of the Internet postmasters, who are usually living, breathing system administrators.

System administrators at large sites are now receiving hundreds to thousands of bounced spam messages each day. Unfortunately, each of these messages has to be carefully examined, because ...