02 Jan 2010

SpamAssassin 2010 rule problems

It appears SpamAssassin has a nasty rule that checks if a mail is “grossly in the future” - by comparing the Date header to a hardcoded regex pattern:

header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]

This worked fine up until midnight at the end of 2009, until we rolled over to 2010. Now every mail received will trigger the FH_DATE_PAST_20XX rule. Luckily the default score for this rule is quite low (although I don’t know exactly what it is) - because it doesn’t appear to be causing any false positives with SJKWI’s mail.

A “fix" (just postponing the inevitable really: change the pattern to match >= 2020 instead) has been pushed to the updates.spamassassin.org domain as of today. To get this update, run sa-update and verify it has changed by running:

grep FH_DATE_PAST_20XX /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf

The rule should now read:

header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]

Note the pattern has changed to 20[2-9]. If you do not run a site-wide installation (so the above directory doesn’t exist), add the following to your local.cf file to effectively disable the rule:

score FH_DATE_PAST_20XX 0.0

Any rule with a score of 0.0 will be removed from the matched list and won’t appear in the headers (and won’t effect the classifying of spam). It’s not a permanent fix, but will stop the problem for now.