arrow-left arrow-right brightness-2 chevron-left chevron-right facebook-box facebook loader magnify menu-down rss-box star twitter-box twitter white-balance-sunny window-close and broken spam filters
1 min read and broken spam filters is often lauded (and rightfully so) for its exceptional spam filtering, but what to do when the filters start breaking down? It seems that after the file that contains your filtering rulebase (~/Library/Mail/LSMMap2) becomes too large, effectively stops catching spam. I’ve experienced this more than once and each time it has come on rather suddenly, leading me to believe that there is a specific filesize threshold that, when crossed, breaks the filters (the last time I noticed this the size of the LSSMap2 file was ~8.5MB).

The only way to fix this is to remove the LSSMap2 file ( recreates a new, blank file when you restart the application). Yes, this means that you have to start training the application again, which, for at least a little while, puts you in the same position you were in before you removed the file.

Enter JunkMatcher:

JunkMatcher filters spam using flexible regular expressions, IP query against multiple blacklists (such as and varoius other techniques such as email property matching, HTML final rendering matching etc. You can match against almost every bit of a message (including attachment filenames and charsets), and the raw material for matching is cleaned out for you to defeat some of the tricks spammers use to obfuscate their messages.

To get my rules back on track again, I simply let JunkMatcher define the native filters by using it for a few days. This means that you have to actively look for false-positives (I always get quite a few with JunkMatcher’s default rules), but I’ve found that after just two or three days (given the extremely high volume of spam I get; >2000/day) the filters have been trained well enough that I can turn JunkMatcher off (until LSSMap2 decides to shit on itself again).

It isn’t the best solution, but for now it does the trick and has stopped me from implementing Knowspam or something similar.

You've successfully subscribed to Justin Blanton.
Success! Your account is fully activated, you now have access to all content.