> There are really only two ideal spam indicators: > > (1) Who sent it. > (2) What proportion of the people who got it, didn't want it. > > Unfortunately there's no way to directly apply either of those criteria.
Not true, and you just gave me an idea. For both the ISP I help at and also the company who pays my bills there is a large amount of spam which is sent to a large number of people at the same domain. Now I know SA has tests for "similar" email addresses but IIRC it only checks the user part of the address (i.e. -->user<--@domain) -- perhaps another test that that checks the other end? Now we also have lots of PHBs that like to CC a dozen people on the list but I think even a score of 5 or 6 would be fine, especially since the user would be from a whitelisted domain. Of course the GA would help. :-) OT: is it possible to add a configuration option which lists the domain mailservers and their IPs? And add a test which scores rather highly for mail claiming to come from domain.dom but which isn't actually from one of the mailservers for domain.dom? I am seeing a lot of spam that is tripping up the whitelist because it's from a whitelisted domain (the domain I run SA on). Regards, Andrew ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek We have stuff for geeks like you. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
