I've recently been working on trying to cleanup the volume of spam some of my users get, and have hit some walls as to how I should proceed.

Recently I switched to using postfix instead of qmail due to the ipv6 issue qmail had, and plesks knowledge base suggested switching to postfix. So I made the switch and everything seems to work fine now in terms of sending/receiving emails compared to qmail with the ipv6 issue anyway.

When I started with my server it was a plesk 9.x system, and spam training was done from the plesk panel. Then I got upgraded to 10.4.4 and training is now done through horde, or imap by moving emails into the spam folder. So here is where the questions start.

How can I verify that spamassassin is running the training daily on emails in the spam folder? i'm not sure what to look for in the logs if anything to know that its running the training. The emails that are coming through that are not marked as spam but should be are getting scores in the negatives. If spamassassin trains all emails that come into the inbox as ham, if there have been months of people not moving anything into the spam folder, this would have trained a lot of false hams correct? If so, would it make sense to somehow wipe out that users spam training database and start fresh?

Secondly, I've seen a couple posts about pyzor, and razor, and other plug-ins. would these make sense to add onto my server? They seem pretty straight forward for install, but i've seen a couple different instruction sites for installing them, and each is different. Some say just run yum to download them, and restart spamassassin and your good to go, others mention editing all sorts of configuration files. Just wondering which way I would have to go if installing those is a good idea.

Thanks for any help anyone can pass my way.

pyzor, dcc and razor are pretty easy to add. Just install those from the atomic repo and restart spamd

thanks. I just ran the install for pyzor, razor, and dcc. installs all said complete!. I have now restarted the psa-spamassassin service.

Is there any way to verify that those plug-ins are now running?

the maillog does show the service shutting down and restarting. but doesn't show any sort of plug-in list. Didn't really think it would, but figured that would be the first place to check.

Also I noticed in my email headers while looking at the spam scores these lines:

X-No-Auth: unauthenticated sender
X-No-Relay: not in my network

Any thoughts on why/what is going on there? I get those when I email myself from a gmail account, or any other accounts for that matter. seems all emails coming in have those two lines.

ok, after some more looking at headers, I can see that razor is definately working. I have seen emails that have the following in their headers on the spam check:
RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK

However they are still not getting marked as spam because they are too low (score of 1.9 on the one i'm looking at)

I have noticed that all emails seem to have BAYES_00 in their list. which is why they are getting such a low score. I'm guessing due to lack of training, and just deleting spam through pop and not moving spam to the spam folder too many emails have been flagged as good that weren't.

My guess is that due to not training and leaving everything in the inbox plesk taught spamassassin everything was good, which is why everything is hitting on BAYES_00. If that is the case, can i just delete the bayes_seen, and bayes_toks files from the users folders in /var/qmail/mailnames/xxxxx/xxxx/.spamassassin ? and would they automatically be recreated during the next nightly learning session?

If my guess is incorrect, and there might be something else causing all emails to be flagged as BAYES_00 can someone point me in the right direction for what to look into next?

Thanks