What spam filtering is built in, and how do I add SpamAssassin?

[RainbowWizard-coder]

Our users get a fair amount of spam through hMailServer. I can see some anti-spam settings in the Control Panel, but I am not sure what is actually switched on, or whether I need SpamAssassin as well.

What does the server do on its own, how do I connect SpamAssassin, and what is a sensible way to start without losing real mail?

[RainbowWizard-coder]

Start by looking at what you have. Spam filtering > Spam filtering overview in the Control Panel is a read-only page with the whole configuration on one screen: which checks are on, what each scores, what the thresholds then do, and which checks are switched on but cannot run.

How it decides: every check that fails adds a score, and two thresholds on Spam filtering > Anti-spam settings (General tab, Thresholds & actions card) decide what the total means.

Threshold	Default	At or above it
Spam mark threshold (score)	5	The message is delivered but tagged: X-hMailServer-Spam: YES, reason headers, and an optional subject prefix
Spam refuse threshold (score) (older versions called it the delete threshold)	20	The message is refused during the SMTP conversation - or quarantined, if quarantine is on and the verdict came after the body

The checks built in, before the body arrives and after it:

• Blocked senders, and allow and block lists per server, domain and account.
• DNS block lists (DNSBL) for the connecting address, and SURBL for the links inside the message.
• Greylisting: an unknown sender is asked to try again later; real mail servers retry and pass.
• HELO host, PTR and sender MX checks.
• SPF, DKIM, DMARC and ARC - the sender-authentication results.
• An external filtering engine over HTTP (FilterHookUrl), such as rspamd, whose verdict arrives as one more score.
• Quarantine, per-account overrides of the thresholds, spam traps, and country blocking, which needs a MaxMind-format country database you supply (GeoIpDatabaseFile; the server ships none).

Most of this is off to begin with. On a new installation that keeps the shipped settings (on Windows, the installer's default on its Server profile page, None - keep the settings this version ships with), DMARC is the only one of these tests that is on. The blocked-senders, allow and block lists start empty, and the DNS block lists and SURBL ship as inactive rows. Greylisting, the HELO, PTR and sender MX checks, SPF, DKIM, ARC, SpamAssassin, the filter hook, quarantine, spam traps and country blocking are all off until you switch them on. (DMARC still checks SPF and DKIM for its own verdict.) A server upgraded from an earlier version keeps the switches it had; the overview above shows which are on.

Two things that surprise people, both deliberate: a session that signed in is never spam-tested (your own users' outbound mail is left to the per-account sending limits, [SendingLimits] in hMailServer.ini, which hold nobody until you set them), and a sender on the exemption list (Spam exemptions) skips the tests entirely, not just the scoring.

Adding SpamAssassin. The server talks to any SpamAssassin daemon (spamd) over TCP, on the same machine or on a Linux host:

1. Run spamd where the server can reach it.
2. In Spam filtering > Anti-spam settings, the Content filters tab, SpamAssassin card: tick Use SpamAssassin, set Host and Port (127.0.0.1 and 783 by default), press Test SpamAssassin connection, and then Save changes.
3. Choose between a fixed score for a message SpamAssassin tags (Score when not merging, 5 by default) and Merge SpamAssassin score into hMailServer score, which uses SpamAssassin's own score (its whole-number part) instead.

SpamAssassin's own headers stay on the delivered message. If spamd does not answer in time, the message is accepted without its verdict and the error log says so (HM5508); a SpamTestSpamAssassin line with a Time: of ten seconds or more means spamd is unreachable or overloaded, and it slows every message's acceptance - see Diagnosing Stalled Mail. That line is an application event, not a debug line: it is written while Logging enabled and Application events are ticked on Monitoring & troubleshooting > Logging, both off on a new installation. For learning, SpamAssassinLearnOnMove=1 tells spamd (spamc's TELL command) that a message moved into the Junk folder is spam and one moved out of it is ham. spamd accepts that only when it was started with --allow-tell, which is why the setting is off by default. A built-in learning classifier is deferred, with the reason written down in Roadmap.md: SpamAssassin's Bayes and rspamd already do it.

A sensible start: switch on the tests you want, then run for a fortnight with the refuse threshold at 0 (0 means never: nothing is refused or held on its score), read what got tagged, and only then set it, well above anything legitimate scored. Publish SPF, DKIM and DMARC for your own domains too (the wiki's DNS for Your Domain), so that other servers' filters trust your mail.

Viruses have a group of their own, Virus scanning: its Anti-virus settings page has the ClamAV (clamd), ClamWin and Custom scanner tabs.

Read more: the wiki's Stopping Spam (every test in the order it runs, with its setting and score; its page names are the older "Spam & virus filtering" ones), Stopping Viruses, and Greylisting.md.

If this does not answer it, ask a new question here with your version, platform and database, and the X-hMailServer-Reason headers of a message that was scored wrongly.