> > Would it be feasible to add a test for the time of arrival of an > > e-mail? Used alone it is no good, but in the Declude > weighted system I think it would be very useful. I've asked this some month's ago and I think it could be helpfull if used with an apropriate weight. For example look at the attached diagram: -Shows 24 hours of email traffic on our server -every orange dot stand for a processed message and the determined weight -our weighting system is set up to hold on 100 points (yellow line) So you can read it like 100% of your own hold weight. -the black line is the average value of the weighting result With this new possible test we could create a hold line like the green one in this diagramm. We've requeued 18 false positives in the last 14 days. 17 of them was hold in the time range from 8 AM to 10 PM >From the 17 FP's 10 was in the weight range between 100 and 110 points. So if we could increase temporaly the hold weight (or otherwise add a negative weight) durring business time we should be able to cut down our FP rate to under 50% I know that doing this will let pass also some additional spam messages (8 on the day showed in the diagram) but that number is very low in comparison to around 1100 hold spam messages any day. Clearly: All this will work only if the mailserver process most if all legit messages durring a identifyable business time. Markus
<<attachment: returncodes.gif>>
