I have a number of vanity catch-all email domains. Back in the day, that was a good idea, and now it's too late to change for my friends and family.I do not relay out, only serving incoming domains. Those incoming messages then get forwarded using mail aliases rules that each user locally configures. I am receiving mail and forwarding to user gmail inboxes using postfix. To make sure I filter out 90%+ of the spam, I run spamassassin with auto-update, as well as two RBL blocking lists and SPF records. Good mail does get through to Google, which is great!Bad mail that still slips through the net ends up with a 421 temporary denial from Google. Typically Google will say this is spam or this contains bad links in the reject message, which is good as far as it goes, but I don't read the logs every hour and check every message.Currently, I run a command that flushes the deferred queue once a day, so that I don't re-try the same spam too often. This is somewhat fragile, because a single message that arrives right before the flush, and then gets deferred once for some technical reason (TCP timeout etc) would also get deleted without delivery. Not great!So, how can I go about training my spanassassin based on the messages received back from Google?For now, I'm thinking of something that wakes up every 10 minutes, tails the mail.log file, and looks for 421 messages, extracts the message ID using regex, then runs postcat on that message, and feeds it to sa-learn for training.First: Is something like this already available? I can't find anything obvious googling spamassassin learn from gmail or similar.Second: Can you find anything wrong, missed assumption, etc, in my reasoning above that I should correct?
How can my postfix/spamcop learn from Gmail 421 rejections?
postfix