Question:

What are the recommended Spam filter settings for MDaemon?

Answer:

There is a comprehensive guide to effective spam filtering available at http://www.zensoftware.co.uk/downloads/media/featurebriefs/MD.EffectiveSpamFiltering.pdf which we strongly recommend is followed. The below provides a brief overview of this document.

PLEASE NOTE: If you are running MDaemon 9.5.* Pro and SecurityPlus for MDaemon 3.* onwards then we'd recommend this Spam Filtering article is followed as SecurityPlus for MDaemon provides additional Spam Filtering functionality - http://www.zensoftware.co.uk/kb/article.aspx?id=10171

Our initial recommendation is that in the MDaemon Interface (GUI) you choose the "Put the Message in the Spam Trap Folder" radio button under Security -> Spam Filter -> Spam Filtering -> . Either setting the "delete the message" or "bounce the message back to sender" radio buttion is not recommended as this means that a message that may have been incorrectly flagged as spam by MDaemon cannot be reviewed and in the case of the latter option will most likely result in the bounce message sitting in the MDaemon retry queue as the mailserver that is the source of the spam won't accept it.

By applying this setting, any message that is scored above the rating at Setup -> Spam Filter -> Heuristics will be routed into this spam trap folder.

The easiest way to then review the contents of this folder is via WebAdmin (Webadmin is a free plugin which can be downloaded from http://www.zensoftware.co.uk/mdwa/ and once installed is logged into via http://IPofWebServer:1000).

Once WebAdmin is installed if you login to it as a MDaemon Global or Domain Administrator, under 'Security' -> 'Spam Trap Folder' you can review all email that has been flagged as spam. If MDaemon has incorrectly flagged a message as spam you can release it so that it routes into the user account it was originally destined for (but is not then re-scanned by the spam filter).

If you have 'Bayesian Learning' enabled (under 'Security' -> 'Spam Filter' -> 'Bayesian') you also have the option to release the message and copy it to the non-spam folder.

The 'Bayesian Learning' feature of MDaemon is a process which runs every night at midnight. During the day it holds known spam and incorrectly flagged spam (routed by the method detailed above and also the method below) and performs calculations on it. Based on these calculations it adds to its spam database and actually learns from the mistakes it made so that it gets better at flagging spam in the future. To reference this spam against valid email it also copies a subset of valid email into its non-spam folder and after its nightly processing deletes the copied email it has placed in this folder (it does not delete the original email, only the copy).

In addition to the 'Spam Trap Folder' method of routing incorrectly flagged spam into the non-spam Bayesian folder for review, enabling Bayesian also creates two public folders that are visable to IMAP, Outlook Connector or WorldClient users. These users can then use to copy spam messages into the 'Spam' Public Folder that have not been flagged as spam by MDaemon, and also *real* messages it can compare with into the 'Non-Spam' folder. For security, by default although standard MDaemon users can copy messages into these folders they cannot view their contents.

If you have any POP3 users that want to also ensure spam messages that haven't been flagged by MDaemon are processed by the 'Bayesian Learning' feature, they can do so by attaching the spam email to a new email and sending it to spamlearn@domain.com (replacing domain.com with your actual domain). Please note however that in order for POP3 users to be able to do this they must be using authenticated SMTP when sending email.

By taking the steps above and periodically monitoring the Spam Trap Folder, MDaemon will improve its accuracy at flagging spam and also give a failover should a message be incorrectly flagged.

Increasing the 'aggressiveness' of the spam filtering

By default MDaemon's spam filter threshold score (ie. the score that decides whether a message is treated as spam or not) is set at 5.0.  This value is a good one for most setups but is fairly conservative.  Gradually reducing this value by small steps can have a significant effect on the amount of spam that is detected.

You should be aware though that reducing this threshold may also increase the number of genuine messages that may be incorrectly flagged as spam (ie. false positives).  This issue can offset however, by using WebAdmin on a daily basis to feed the false positives back to MDaemon so that it's Bayesian classification can learn from its mistakes.

Our recommendation is to start with the default threshold value of 5.0 and then gradually reduce the value by 0.1 every few days until you reach a level that you're happiest with ie. where the quantity of missed spam messages and the quantity of false positives are both low.  On our server her, our threshold is set at 3.8 but bare in mind that the optimum value will vary from site to site.

The spam filter's threshold value can be configured under Security -> Spam Filter -> Heuristics tab as shown here:-

Possible issues to note:

If you want your Bayesian Databases to be flushed before adopting the above settings then you can do this by taking the steps below:-

1. Stop Mdaemon (From the MDaemon Interface (GUI) choose File -> Stop MDaemon).

2. In Windows Explorer, navigate to \<path-to-MDaemon-install>\MDaemon\SpamAssassin\Bayes\ and delete the contents of the Bayes Folder.

3. Start MDaemon (Start -> Programs -> MDaemon -> Start MDaemon)

This process will prompt MDaemon to completely rebuild the Bayesian Databases.