Bypassing SpamAssassin when using SMTP_AUTH

From braindump
Jump to: navigation, search

Until very recently I had absolutely no issues with my SpamAssassin configuration at all. But since I happen to be mostly connecting from Sunrise which seems to be universally blocked by I had to look for another solution. Since I have been using SMPT_AUTH since like forever over TLS or SSL this configuration should do the job.


Firstly we create a new file in /etc/postfix/include called add-auth-header.regexp with something like the below. Replace <RandomWord with somewhat unique word or string of letters and numbers:

## use this to a token to SpamAssasin to let authenticated
## bypass the spam filter
/^/ PREPEND X-<RandomWord>: no

Then under /etc/postfix/ the smtpd_recipient_restrictions or the smtpd_data_restrictions have to look somwhat like the example below. The outcome depends on what is already in place.

smtpd_recipient_restrictions = permit_mynetworks,
                               check_client_access regexp:/etc/postfix/include/add-auth-header.regexp

After all is done reload postfix.

Note: In the references below there is one more configuration step described touching of postfix which was not required for my configuration.


In SpamAssassin's or when on a debian based distro under /etc/mail/spamassassin create a file called with the following content. Note: <RandomWord> needs to be the same as in the add-auth-header.regexp:

header __NO_SMTP_AUTH X-<RandomWord> =~ /^no$/m 
descrinibe SMTP_AUTH Message sent using SMTP Authentication 
tflags SMTP_AUTH nice 
score SMTP_AUTH -10

After that reload SpamAssassin


Sending mail from and outside address account such as Hotmail, Yahoo, Gmail or from the one that came with your ISP contract you should find a new header in the mail header called X-<RandomWord>.

However when sending vi the MTA via SMTP_AUTH the header should not appear.