Overview

For clients on our Plesk servers (e.g., Canada20), SpamAssassin is a dynamic filter that relies on Bayesian Learning to adapt to the specific types of "nefarious" mail targeting a business. Success depends on user interaction and technical data.

The "Learning" Mechanism in Plesk

Plesk monitors IMAP folder movements to optimize the filter without over-tightening the sensitivity score.

1. Training the "Spam" Filter

• Action: Client moves a message from Inbox → Spam/Junk folder.
   

• Technical Backend: Triggers sa-learn --spam.
   

• Result: System extracts "tokens" (IPs, phrases, hidden HTML). Future similar emails receive a higher spam score automatically.

2. Training the "Ham" (Legitimate) Filter

• Action: Client moves a message from Spam → Inbox.
   

• Technical Backend: Triggers sa-learn --ham.
   

• Result: "Un-trains" the filter for that sender/format to prevent future false positives.

Plesk Support Workflow for Agents

Critical: The "Email Header" Investigation

If a specific type of spam repeatedly bypasses the filters, the Hosting Team needs to see the "fingerprints" of the email.

• The Rule: Instruct the client to forward the spam as an attachment.
   

• Why? A standard forward strips the Email Headers.
   

• The Goal: Headers allow the Hosting Team to inspect the X-Spam-Status, the Received trail, and the DKIM/SPF results to see exactly which security layer the spam is slipping through.

Agent Script: "To help our engineers block this at the server level, please forward a few examples as an attachment. This preserves the technical headers we need to identify how these messages are bypassing our current filters."

Important: The IMAP Requirement

For "Training" to work, the client must be using IMAP.

• Note: If a client uses POP3, the server cannot "see" what the user does with the email once it is downloaded. No Bayesian training will occur on POP3.