Harry, et al -- ...and then Harry Putnam said... % % Bart Schaefer <[EMAIL PROTECTED]> writes: % % > On Tue, 4 Jun 2002, Harry Putnam wrote: % > ... % >> FORGED_YAHOO_RCVD version=2.20 % >> % >> Yet a grep of the received headers reveal no instance of yahoo. % > % > I'll answer since this has come up before and I suggested the rule. % > % > Read the description, not the rule name. The name is an abbreviation % > chosen more for similarity to names of other rules that examine Received % > headers than for congruence with its description. In this case it means % > that the message claims to be From: yahoo.com but (as you noticed) does % > NOT mention a yahoo mail server in the Received: headers. It's very ... % % Thanks, I guess it makes sense, but I have to say that reading the % description: % describe FORGED_YAHOO_RCVD Forged yahoo.com 'Received:' header found % % Comes no nearer to making it clear what is really happening.
I must admit that something like FORGED_YAHOO_FROM Forged yahoo.com addr with no matching 'Received:' hdr would be clearer to me, too. But, hey, I'm new :-) % % > And please excuse me for saying so, but 2.0 is a ridiculously low spam % > threshold. I'd lose half my email if I were to set it below 4.0. % % Some one else pointed that out to, and I am watching closer now. % I've also had to edit a number of other rules score values so % probably just got off on the wrong foot. Could be. I've left things as they are as I watch what comes through, and I know that I'm going to have to whitelist some very spammy things, but otherwise most of my good mail is below 4 and most of my questionable mail is in the 5.5-7.0 range. It seems easier for me to bump the threshold up than to work all of the scores down, especially when planning ahead for the next release (see other thread for thoughts on that, though). HTH & HAND :-D -- David T-G * It's easier to fight for one's principles (play) [EMAIL PROTECTED] * than to live up to them. -- fortune cookie (work) [EMAIL PROTECTED] http://www.justpickone.org/davidtg/ Shpx gur Pbzzhavpngvbaf Qrprapl Npg!
msg05857/pgp00000.pgp
Description: PGP signature
