Just to clarify on the issue, the issue with the one rule did not cause all email to be marked as spam (you didn’t say it did, I just want to make sure there’s no confusion). Judging by the stats in the STATISTICS-set3 file included with the Apache SpamAssassin 3.2.x tarballs, even with the rule issue SpamAssassin would have correctly classified approximately 98% or more of ham emails correctly when using the default spam threshold of 5.0. This is the result of a core principle of SpamAssassin of not too heavily relying on any single method of spam detection.

Further, many people have reported that no ham emails were incorrectly identified as spam (on their systems) as a result of this rule issue while others have said that extremely few were identified. While we’re disappointed that this issue happened we are pleased to see that the robustness of SpamAssassin has prevented the issue from being a bigger problem than it was.

While I’m here, I’d like to mention that another alternative to auto-deleting (bad idea!) spam or quarantining it is to not accept it in the first place. If an email is not accepted; a properly working email system will notify the sender so that they will be aware you did not receive the email. This prevents the problem of people not going through a quarantine folder (who wants to do that, that’s why you’ve got a spam filter in the first place) and nobody (the sender nor the recipient) knowing that you didn’t receive the email.

Regards,

Daryl