Pyzor

Pyzor requires that port 24441 UDP IN / OUT be opened if you are using a firewall.

Pyzor is a collaborative, networked system to detect and block spam using identifying digests of messages. See https://www.pyzor.org/ for more information about Pyzor.

How it works

Pyzor detects spam by turning each message into a short "fingerprint" (a digest) and counting how many other Pyzor users have reported the exact same message as spam. Spammers typically send the same message to large numbers of recipients, so a message that has been reported many times is very likely spam.

The digest is generated on your mail server and sent to the Pyzor server that Warden is configured with — by default the well-maintained public server at public.pyzor.org:24441 (the port noted above) — which answers with two numbers: how many times the message has been reported as spam, and how many times it has been whitelisted as not-spam. Since the entire system is released under the GPL, people are free to host their own independent servers if they prefer.

For each incoming message, Warden (through the Mail::SpamAssassin::Plugin::Pyzor plugin it enables in SpamAssassin) does the following:

  1. Computes a digest of the message body.
  2. Sends it to the Pyzor server via the local Pyzor client.
  3. Receives the spam-report count for that digest.
  4. If the count is at least the threshold configured with pyzor_count_min (default 5), the PYZOR_CHECK rule hits and adds to the message's spam score.

The second number — the count of whitelistings — acts as a counterbalance, since a legitimate message can also be sent to many recipients. If enough users have whitelisted a digest as not-spam, the spam result is suppressed. The more a message has been reported as spam, the more whitelistings are required to cancel it out: by default one whitelisting per 5 reports (pyzor_welcomelist_factor, default 0.2) and never fewer than 10 (pyzor_welcomelist_min) — so a message reported 50 times as spam is ignored only if it has also been whitelisted at least 10 times. These settings were renamed from pyzor_whitelist_min and pyzor_whitelist_factor in SpamAssassin 4.0, where the old names still work as aliases until 4.1.

On SpamAssassin 4.0+, the pyzor_fork option runs the Pyzor query in a forked process and reads the result in later (similar to async DNS lookups), which increases throughput.

Testing

To verify that Pyzor is working, run the following command as the amavis user. It uses Warden's default home directory, so it tests the same server the SpamAssassin plugin queries. A working connection responds with (200, 'OK'):

# sudo -u amavis /usr/bin/pyzor --homedir /etc/mail/spamassassin/.pyzor ping
public.pyzor.org:24441  (200, 'OK')

Rules

Area Rule name Description Default scores
full PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/) 0 1.985 0 1.392

Related Pages