SpamAssassin is an integral part of Maia, which scans messages and assigns them a score based on a combination of heuristics (feature recognizers), DNSBLs, URIBLs, collaborative anti-spam networks, and a Bayesian classifier. It can be found at its official site.

Paul Westbrook shares his experience with upgrading SpamAssassin to 3.0

Additional rule sets for SpamAssassin can be found at the SpamAssassin Rules Emporium (SARE).

To auto-update SpamAssassin rules, consider using the Rules du Jour script.

Recommend rulsets, from mailing list message on 1/25/2006:

For SpamAssassin versions 2.50 to 2.64:

TRUSTED_RULESETS="SARE_REDIRECT SARE_EVILNUMBERS0 SARE_BAYES_POISON_NXM
SARE_HTML SARE_HEADER SARE_SPECIFIC SARE_ADULT SARE_BML SARE_FRAUD
SARE_SPOOF SARE_RANDOM SARE_OEM SARE_GENLSUBJ SARE_UNSUB SARE_URI0
SARE_OBFU0";

For SpamAssassin versions 3.0 and later:

TRUSTED_RULESETS="SARE_REDIRECT_POST300 SARE_EVILNUMBERS0
SARE_BAYES_POISON_NXM SARE_HTML SARE_HEADER SARE_SPECIFIC SARE_ADULT
SARE_BML SARE_FRAUD SARE_SPOOF SARE_RANDOM SARE_OEM SARE_GENLSUBJ
SARE_UNSUB SARE_URI0 SARE_OBFU0";

In general, note that some of the SARE rules are available in varying
levels of risk, where lower numbers are more conservative and higher
numbers are more likely to produce false positives.  For example, the
SARE_GENLSUBJ rules are available in five levels (SARE_GENLSUBJ0,
SARE_GENLSUBJ1, SARE_GENLSUBJ2, SARE_GENLSUBJ3, and SARE_GENLSUBJ4).
Specifying just "SARE_GENLSUBJ" gets levels 0-3, but not 4.  If you want
to be more conservative, just get SARE_GENLSUBJ0; if you decide that's
not aggressive enough, add SARE_GENLSUBJ1, and so on until you find the
level that works best for your needs.