Resend false positive spam

A mailserver with Exim, Amavis, Spamassassin and Clamav.

Mails that are ham, were recognized as spam and are sitting now in the quarantine directory (for amavis often /var/lib/amavis/virusmails/spam-*). How to resend them properly?

Finding the spam in the quarantine directory and resending it with the following command:

zcat MAILFILE | sendmail -i -f FROM TO (Amavis usually compresses Spammails)

But first you need to make sure, that the mail is not recognized as spam again. My solution is to add the mail itself to the bayes database of spamassassin and to add the sender to a whitelist. For example:

zcat MAILFILE | sa-learn –ham

I wrote a script in Perl that does all these things. It was designed to be called from a webinterface where the quarantine folder is displayed and the user can choose to delete mails or reassign and resend them. What it can do:

Deleting mails (one specified, all mails, or all mails older than a day/week). Reassigning mails as ham, resending and deleting it afterwards.

How it does that:

• Deleting is easy. A find is doing the job.
• Assigning as ham and resending it:
• First do a sa-learn with the mail.
• Add the sender to a whitelist (a file in this case) and reload Amavis.
• Sending the mail again with sendmail -i -f FROM TO.
• Deleting the mail if successful before.

USAGE: rm_spam COMMAND DATA [FROM] [TO]

COMMAND can be delete or ham. DATA with the command delete can be all/week/day or a filename, with ham it can only be a filename. For ham it is also necessary to provide the sender and recipient.

This should also work with Postfix instead of Exim. It is possible to omit the -f FROM. Advantage you only need to put the root-account (root@HOSTNAME) in the whitelist, but the recipient will receive the message from root and not from the originating sender.