Detecting Spam

In some instances, it may be preferable to deliver all spam messages to envelope recipients. For example, site administrators would consider this action when initially testing and optimizing PureMessage. In this situation, a spam detection filter is beneficial for identifying spam and delivering all messages to recipients with an associated spam probability. During the optimization process, mail recipients could then comment on the accuracy of a particular filter.

Note The optional PureMessage-Policy-Spam” component is required to use the “spam detection” filter.
# attr NAME=spam detection
# Detects spam probability over 50%.
# Prefixes ’subject' header with '[SPAM:]'.
# Adds an 'X-PMX-Spam' header.
if pmx_spam_prob :over 50 {
    pmx_replace_header "Subject" "[SPAM:%%GAUGE%%] %%SUBJECT%%";
    pmx_add_header "X-PMX-Spam" "Probability=%%PROB%%";


  • If the pmx_spam_prob test finds the message has a spam probability of 50% or more:
    • The pmx_replace_header action prefixes the “Subject” of the message with a string similar to: [SPAM:###], where each additional “#” character denotes 10% above the argument to pmx_spam_prob (at least one '#' is always appended, indicating that the message contains 0-50% spam).

      Example: Using this filter, a message with a spam probability of 60% would have its “Subject” header prefixed with [SPAM:##]. A message with only 50% probability would have its “Subject” header prefixed with [SPAM:#].

    • The pmx_add_header action then adds an “X-PMX-Spam” header to indicate the message’s numerical spam probability. The message header displays as follows:
      X-PMX-Spam: Probability=63%
    • The stop command then ends message processing.

Where does this filter go?

The “spam detection” filter replaces the “Copy to quarantine and deliver if spam probability is 50% or more” filter in Policy Script 6: Calculate Spam Probability, Modify and Deliver. Replacing the first part of this default policy filter with the “spam detection” filter ensures that:

  • The “spam detection” filter executes when messages from external hosts contain over 50% spam.
  • Messages with a spam probability of 50% or more are not quarantined. Headers are added with an associated spam probability.