SpamAssassin allows entire third-party rulesets to be installed simply by placing them in the sitewide configuration directory (usually /etc/mail/spamassassin).
There is a collection of CustomRulesets that have been contributed by members of the SpamAssassin community. These rulesets, while very effective, have not gone through the same "quality assurance" that the main rules have gone through. Thus, use of these third party rulesets is "at your own risk".
Where do I put rules ?
(FIXME: move to WhereDoLocalSettingsGo)
(copied from http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt )
is best if you want to have a rule only run when a particular user runs SA. Bear in mind that this is the user that executes SA, not the user who the mail is addressed To:. If you run SA from a sendmail milter, the only user_prefs that will be used is the one for the user sendmail runs as (usually root). Even if you do have a site-wide configuration, user_prefs may be useful to you by allowing you to add rules to another user account's user_prefs and test them using the command line prior to adding them to your local.cf.
Note: if you use spamd, rules placed in user_prefs will be IGNORED by default.
Do not add your rules to the .cf files in /usr/share/spamassassin . When you upgrade SA (and you should do so somewhat regularly), all the existing rules in /usr/share/spamassassin will be deleted and replaced by the new default ruleset.
/etc/mail/spamassassin/local.cf is the place of choice for site-wide application of a rule. Rules placed here get applied no matter what user invokes SpamAssassin. Multiple "cf files" can be placed in this directory (/etc/mail/spamassassin/*.cf) and they will all be included in the site-wide configuration.