Since things are fairly stable now with 2.31, might I suggest we share our
local.cf updates to learn from each other what site-specific tuning we have
done. May help the whole group and give ideas for better base rules.
============ local.cf ================
--- snip ---
required_hits 5.1
score USER_IN_BLACKLIST 20.0
score USER_IN_WHITELIST -20.0
score CTYPE_JUST_HTML 1.7
score RELAYS_ORDB_ORG 0.0
score RCVD_IN_ORBS 0.0
score RCVD_IN_BL_SPAMCOP_NET 2.0
score RAZOR_CHECK 2.0
score DCC_CHECK 3.0
body OFFSHORE_SCAM /offshore .{0,20}(credit
cards|companies|accounts?|financial|website)/i
describe OFFSHORE_SCAM Off Shore Scams
score OFFSHORE_SCAM 2.0
body VACATION_SCAM /(free|mini-?|dream).{0,10}vacation|vacation
(offer|promotion|package)/i
describe VACATION_SCAM Vacation Offers
score VACATION_SCAM 2.0
body FREE_STUFF /free (cell
phone|preview|debt|money|bargain|access|website|dvd|leads|sample|signup|host
ing|tickets|offer|flag|quote|investment|pics)/i
describe FREE_STUFF Stuff for Free
score FREE_STUFF 2.0
body CREDIT_CARD /consolidate.{1,15}debt|credit
card.{1,10}(offer|debt|bankruptcy|decision)|accept.{1,10}credit
cards|creditors
calling|unsecured.{0,20}(mastercard|visa|discover|credit|loans|debt)|all.{1,
9} credit bureaus?|(bad|no|eliminate|(re)establish|damag).{0,15}
(credit|debt)|debt (consolidation|elimination)/i
describe CREDIT_CARD Credit Card, Credit, Debt Relief
score CREDIT_CARD 2.0
header SUBJECT_HAS_DATE Subject =~ /1?\d[-\/][1-3]?\d[-\/](20)?02/
describe SUBJECT_HAS_DATE Subject contains a date
score SUBJECT_HAS_DATE -4.0
header FROM_NEWS_LIST From =~ /(\@news|\@list)/i
describe FROM_NEWS_LIST From: has a news or list hostname in FQDN
score FROM_NEWS_LIST -2.0
header FROM_US_PHONE From =~ /^[2-9]\d{9}\@/
describe FROM_US_PHONE From: looks like US Telephone Number
score FROM_US_PHONE -5.0
header RCVD_IN_NJABL eval:check_rbl('relay', 'dnsbl.njabl.org')
describe RCVD_IN_NJABL Received via a relay in NJABL
score RCVD_IN_NJABL 3.0
header SUBJECT_IS_NEWS Subject =~ /(in review|news|list)/i
describe SUBJECT_IS_NEWS Subject contains news newsletter list daily
weekly or monthly
score SUBJECT_IS_NEWS -4.0
header SUBJECT_FREQ Subject =~ /(monday|daily|week|monthly)/i
describe SUBJECT_FREQ Subject contains monday daily week or
monthly
score SUBJECT_FREQ -2.5
header SUBJECT_MONTH Subject =~ /
(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)/i
describe SUBJECT_MONTH Subject has month in it probable newsletter
score SUBJECT_MONTH -3.5
header RCVD_IN_FIVETEN eval:check_rbl('relay',
'blackholes.five-ten-sg.com')
describe RCVD_IN_FIVETEN FIVETEN DNSBL of Dialups, DSL, Spam Sources
and Relays
score RCVD_IN_FIVETEN 1.0
header RCVD_IN_XBL eval:check_rbl('relay', 'xbl.selwerd.cx')
describe RCVD_IN_XBL Received unconfirmed spam via eXtreme Block
List
score RCVD_IN_XBL 0.5
body DRIVERS_LICENSE /international drivers?\'?s? license/i
describe DRIVERS_LICENSE International Drivers License scam
score DRIVES_LICENSE 3.0
================== End local.cf ===================
<<Dan>>
Dan Smart
Vulcan Materials
-------------------------------------------------------
Sponsored by:
ThinkGeek at http://www.ThinkGeek.com/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
