Free tools Windows power users keep installed
One-click scans. No signup required.
On a Debian or Ubuntu VPS, install SpamAssassin with sudo apt-get update && sudo apt-get install spamassassin spamc, refresh its rules with sa-update, enable the distribution’s spamassassin service, and have your mail server call the spamc client. The daemon (spamd) should stay running locally; invoking the full spamassassin program for every message is slower and is not the normal mail-server design.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What SpamAssassin does on a VPS
SpamAssassin is a mail-filtering engine that scores messages against a collection of rules. Your mail-transfer agent (MTA), such as Postfix, passes a message to SpamAssassin; the scanner adds result headers and, according to your policy, can add a subject tag or route the message for later handling.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The efficient production arrangement has two processes:
spamdis the long-running daemon. It keeps the Perl scanner loaded so each message does not pay the full program-startup cost.spamcis the small client. It sends a message tospamdand returns the filtered result to the MTA. Apache SpamAssassin documentation describesspamcas the client half of this pair.
A direct spamassassin invocation is useful for one-off diagnostics, but an MTA should normally use spamc talking to spamd.
#1 Best Overall
Choose an installation method
| Method | Command or sequence | When it makes sense | Operational cost |
|---|---|---|---|
| Debian or Ubuntu package | apt-get install spamassassin (install spamc as well when it is a separate package) |
Most Debian-family VPS deployments | Package upgrades, service units and dependencies are handled by the distribution; exact unit behavior can vary by release. |
| Fedora, CentOS or Red Hat package | yum install spamassassin |
RPM-based systems whose configured repositories provide the package | Use the release’s current package manager and verify the service-unit name before enabling it. |
| Gentoo package | emerge mail-filter/spamassassin |
Gentoo systems managed through Portage | Portage controls dependencies; service setup follows the Gentoo installation on that VPS. |
| Source build | perl Makefile.PL, then make and make install as root |
You need a source release or a build option unavailable in the package | You must maintain the service definition, update-directory ownership, dependencies and upgrade/rollback process yourself. |
For a conventional VPS, the distribution package is usually the least risky choice. A source build is not just a different installer: it transfers ongoing service and upgrade work to you.
Prerequisites and safety checks
Before changing the mail path, make sure you have:
- root or
sudoaccess to the VPS; - an MTA already receiving mail, or a clear plan to install and configure one;
- the hostname, local domains and trusted relay networks that should be treated as local policy;
- a backup of the current MTA configuration and a way to undo a content-filter change;
- a second administration session or console access in case a service reload exposes a configuration error.
Spam filtering is in the delivery path. A bad pipe definition can defer, duplicate or lose valid mail, so make and test one change at a time. Do not begin by rejecting messages: first observe headers and queue behavior.
Install on Debian or Ubuntu
1. Refresh package metadata and install the scanner
- Update the package index:
sudo apt-get update- Install SpamAssassin and its lightweight client:
sudo apt-get install spamassassin spamcThe Apache SpamAssassin project lists apt-get install spamassassin as the Debian/Ubuntu installation path. Installing spamc explicitly makes the intended daemon/client arrangement clear; if your release folds it into another package, APT will report that it is already satisfied.
2. Identify the service supplied by this release
Debian documents that the packaged daemon is disabled by default. The usual unit is named spamassassin, but package-unit details can differ between releases. Inspect the installed units and package README rather than copying a command from another distribution:
systemctl list-unit-files | grep -i spam
systemctl status spamassassinIf the unit is spamassassin, enable it for boot and start it now:
Rank #2
- Pass the Securing Email with Email Security Appliance 300-720 SESA with updated flashcards packed with detailed content aligned to the latest exam blueprint. Cover all core topics without the overload found in lengthy study guides. Get 300+ Securing Email with Email Security Appliance 300-720 SESA flashcards on 8-1/2″ x 11″ perforated card stock.
sudo systemctl enable spamassassin
sudo systemctl start spamassassinIf your package exposes a different unit, substitute that exact name. Confirm that the status is active before connecting Postfix or another MTA.
Recommended Free Tools
3. Locate site configuration
Debian identifies /etc/spamassassin as the site-specific configuration directory. A common local policy file is /etc/spamassassin/local.cf. Back it up before editing:
sudo cp -a /etc/spamassassin/local.cf /etc/spamassassin/local.cf.backupIf the file does not yet exist, create it with the ownership and permissions used by the surrounding configuration files. Keep local policy in this directory rather than editing files managed by the package, so an upgrade does not silently overwrite your changes.
Install on RPM-based Linux
The project documents yum install spamassassin for Fedora, CentOS and Red Hat. On a release that has replaced yum with a compatibility wrapper or another package manager, use the command supported by that release:
sudo yum install spamassassinAfter installation, find the package’s service unit, enable and start it using that unit, and verify that spamd is running locally. Do not assume that a Debian unit name, configuration path or service account exists on an RPM-based system. Check the package documentation on the target VPS before wiring the MTA to it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Pass the Securing Email with Email Security Appliance with updated flashcards packed with detailed content aligned to the latest exam blueprint. Cover all core topics without the overload found in lengthy study guides. Get 300+ Securing Email with Email Security Appliance flashcards on 8-1/2″ x 11″ perforated card stock.
Install on Gentoo
Gentoo’s documented package path is:
sudo emerge mail-filter/spamassassinUse the service-management and configuration conventions of the Gentoo installation. Confirm the daemon is started and that the installed spamc path is the one you will give to the MTA.
Build from source when a package is not suitable
Apache’s installation procedure uses a downloaded release directory named Mail-SpamAssassin-*:
- Extract the release and change into its directory.
- Run
perl Makefile.PL. IncludeENABLE_SSL=yeswhen SSL support is required by your deployment. - Compile with
make. - Run
make installas root.
perl Makefile.PL
make
sudo make installA source install does not automatically give you the distribution’s complete service integration. Create and test a service definition for spamd, decide which account owns the rule-update directories, document where the files were installed, and define how you will upgrade and roll back the build. If those tasks are not part of your maintenance plan, use the distribution package instead.
Refresh SpamAssassin rules safely
Run the rule updater after installing the package or source build:
sudo sa-updateThe updater must match the installed SpamAssassin modules. Apache’s documentation also stresses safe ownership of update directories: routine updates should run as the normal SpamAssassin service user rather than blindly as root. Determine the account used by your package and service, then make sure that account can write the updater’s directories without giving it unnecessary access elsewhere. A source installation requires you to establish this ownership deliberately.
Rank #4
- XGS 108 with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- 6 x 2.5 GE copper ports and 1 SFP fiber port, supporting up to 12.5 Gbps firewall performance for growing business networks.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
sa-update installs new rules, but it does not restart spamd or force an already-running daemon to reload the new ruleset. After a successful update, explicitly reload or restart the daemon using the unit on your VPS:
sudo systemctl restart spamassassin
sudo systemctl status spamassassinIf your service supports a safe reload, use the documented reload action; otherwise restart it during a period appropriate for your mail volume. Inspect the service log after the operation and confirm that the process is healthy.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteConfigure policy in local.cf
SpamAssassin’s site policy belongs under /etc/spamassassin on Debian. The local file is where administrators commonly set:
- whether a suspicious message receives a subject tag;
- the score threshold at which a message is treated as spam;
- trusted networks and local hosts;
- whether mail is tagged for later filtering or rejected during SMTP processing.
Debian documents a default threshold of 5.0: messages scoring 5.0 or higher are tagged as spam by default. Treat that as the package default, not as a universal safe-rejection value. Legitimate newsletters, forwarded mail and messages from poorly configured senders can score unexpectedly. Start by tagging and observing, then adjust policy using your own mail patterns.
Debian also documents that the original message is preserved as a message/rfc822 attachment in the generated report. That behavior affects mailbox size and downstream filtering, so account for it when deciding how long to retain spam.
Best Value
- XGS 88W with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- Built in Wi Fi 6 with 4 x 2.5 GE copper ports, delivering up to 9.9 Gbps firewall performance for secure wired and wireless networks.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
After editing local.cf, validate the syntax with a non-destructive scan and restart or reload spamd so the daemon reads the changed policy. Keep a dated backup of each production policy revision.
Connect SpamAssassin to Postfix
Use the daemon/client pair
Postfix should invoke /usr/bin/spamc (or the path installed on your system), not start the full spamassassin program for every message. spamc submits the message to the already-running spamd process and returns the result to the mail pipeline.
Define a controlled pipe
Debian’s documented Postfix example adds a content filter and a pipe service. The pipe calls /usr/bin/spamc, then hands the processed message to /usr/sbin/sendmail. Adapt the executable paths, service account and recipient arguments to the packages installed on your VPS; do not assume those values are identical on another release.
Make the change in the Postfix configuration files using the same ownership and permissions as the existing configuration. Keep the previous main.cf and master.cf copies so you can remove the content-filter setting and restore normal delivery if testing fails. Once the definitions are correct, reload Postfix:
sudo postfix check
sudo systemctl reload postfixThe exact pipe stanza is release-specific, which is why the Debian package example and your installed README should be treated as the authority for flags, user names and queue behavior. A syntactically valid pipe can still create a mail loop if it reinjects mail into the same filter without an exclusion, so test reinjection and loop prevention before enabling it for all recipients.
Verify the installation without risking normal mail
- Confirm the daemon status with
systemctl statusand inspect its recent log entries. - Run a local, non-destructive test through
spamcusing a message that is safe to discard. The cited documentation does not prescribe one universal VPS test command, so use the input and output method supported by your package and MTA. - Send a test message to a controlled mailbox. Inspect the headers for SpamAssassin result fields and the subject behavior you configured.
- Check the Postfix queue and logs while the message traverses the filter. Verify that it is delivered once, not deferred indefinitely and not reinjected repeatedly.
- Send an ordinary message that should not be considered spam. Confirm that it reaches the mailbox and that the original content remains available.
- After running
sa-update, restart or reloadspamd, then repeat a header check so you know the daemon is using the refreshed rules.
Do not use a deliberately forged high-scoring message as your only test. A successful test must demonstrate both the spam-tagging path and the normal-mail path.
Troubleshoot the common failure points
The service will not start
- Read the unit status and journal for the exact configuration error.
- Check that the service account can read the configuration and write only the directories it needs.
- On a source build, verify that the installed Perl modules and executable paths match the service definition.
- Confirm that another process is not already occupying the local listening socket.
spamc cannot reach spamd
- Verify that
spamdis active before testing the MTA. - Check that the client and daemon agree on the local socket or port configured by the package.
- Use the actual installed path from
command -v spamcin the Postfix pipe. - Keep the daemon bound to the local interface unless you have a specific, secured reason to expose it elsewhere.
Messages are tagged but the score seems unchanged
- Remember that
sa-updatedoes not reload a running daemon; restart or reloadspamd. - Check that the updater version matches the installed modules and that its update directories are writable by the intended service user.
- Inspect the message’s result headers to see which rules actually fired.
Mail is deferred, duplicated or missing
- Disable the content-filter setting and reload Postfix to restore the pre-filter path.
- Inspect Postfix logs for pipe exit status, permission errors and reinjection loops.
- Compare the pipe’s user, command path and recipient arguments with the package’s documented example.
- Re-enable filtering only after a controlled test succeeds for both spam and ordinary mail.
Too much legitimate mail is treated as spam
Do not immediately lower or raise the threshold based on one message. Review the rule results, trusted-network policy and subject-tagging behavior first. Keep tagging enabled while you collect examples; only consider rejection after you understand the false-positive pattern and have a recovery path.
Package installation versus source build
| Decision factor | Distribution package | Source build |
|---|---|---|
| Initial setup | One package-manager transaction plus the release’s service enablement. | Extract, configure with perl Makefile.PL, compile and install. |
| Dependencies | Resolved by the distribution package system. | You must provide and track the required Perl modules and build dependencies. |
| Service integration | Usually supplied by the package; verify the unit and defaults. | You must create, secure and maintain the daemon service definition. |
| Rule-update ownership | Follow the package’s SpamAssassin account and directory permissions. | Choose and document ownership yourself. |
| Upgrades and rollback | Use the distribution’s tested upgrade and downgrade mechanisms. | Retain the source, build options and install paths so you can reproduce or remove the build. |
Choose source installation only when its control is worth the additional operational responsibility. For most single-VPS mail servers, a supported package makes recovery and routine updates simpler.
Quick Recap
Routine operations checklist
- Keep
spamdenabled and verify it after every system reboot. - Run
sa-updateunder the intended SpamAssassin account or through a carefully reviewed privileged mechanism. - Reload or restart
spamdafter rule updates; the updater does not do this for you. - Back up
/etc/spamassassin/local.cfand Postfix’s filter configuration before changes. - Review headers and logs rather than relying only on the subject tag.
- Watch the queue after every filter or reinjection change.
- Keep rejection disabled until false positives, recovery and rollback have been tested with real mail flows.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
