Adrian 'Dagurashibanipal' von Bidder <[EMAIL PROTECTED]> writes:
> While the Date clearly is a bug in the webmail client and should be
> reported there,
>
>> - HTML only message with no text
>> - Outlook-ish headers, but not all of them (indicates someone trying
>> to look like Outlook ... incorrectly)
>
> These two are perfectly legal to have. (But I, personally, wouldn't use
> a webmail generating html-only mails, and would complain if I got
> regularly sent such messages. But this is just a matter of taste).
It may be legal, but non-conformance to email RFCs is only one type of
spam indicator (and some RFC-type rules don't work well). Anyway, SA is
not an email RFC validator. It's a spam detector. If we only used
header and other formatting rules for invalid RFC conformance, SA would
be a lot less effective.
For example, the MIME_ODD_CASE looks for odd-capitalization in the
MIME-Version: header. RFC 2822 says that capitalization does not
matter. But, that rule is as close to perfect as you can get. It
matches 11% of all spam and matches no ham. That's better than any
blacklist, Razor, etc.
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
176545 30101 146444 0.171 0.00 0.00 (all messages)
100.000 17.0500 82.9500 0.171 0.00 0.00 (all messages as %)
1.939 11.3750 0.0000 1.000 0.97 3.81 MIME_ODD_CASE
Of course, MIME_ODD_CASE is a better indicator than the rules that the
UebiMiau mailer hit, but that's why they have lower scores. Those rules
still all have a good S/O ratio (spam/overall ratio of hits for a 50/50
mix of spam and ham).
--
Daniel Quinlan Linux, open source, and
http://www.pathname.com/~quinlan/ anti-spam consulting
-------------------------------------------------------
This SF.NET email is sponsored by: FREE SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
