> > Hi, Right back at ya!
> > Just a warning, I'm a bit of an SA newbie, so I'm half > expecting to get > a bunch of RTFM's back (but I have read the docs too.. maybe just > missed something...) > I've been there! > I've been using SA with qmail-scanner for about a month now Which Version of SA? > been working great. With the default rules and settings, it blocks > about 20k messages a day (company with about 4400 email addresses). > There's about a 2% false positive rate which I am trying to > get rid of. That is a lot!! You may want to stay away from my "evilrules" until I shorten them up Nov 3rd. See sig for more info. > The biggest being email from aol. When a normal honest aol user sends > an email, SA sometimes catches it with a rating of 5-6. Which rules are hitting for that score? > score FAKE_HELO_AOL 50.0 > > then I telnet to port 25 and do a HELO aol.com > However, looking through the debug logs, SA does not catch this. Am I > doing something wrong here? Or maybe I just dont understand the rule.. > I think FAKE_HELO_AOL might not hit that. I'd have to look at the specific rule for which version you are using. > Also, is there a way to take points away from someone coming in from > aol? Instead of whitelisting them, maybe take away 3 points then beef > up some other rules like the fake_helo_aol or rcvd_in_dynablock > > Any help, pointers, or redirects to custom rules would be greatly > appreciated! Well then appreciate away! header FROM_AOL From =~ /aol.com/i describe FROM_AOL Hey, this email says from aol! score FROM_AOL -1.123 (-: Check link in my sig for some more. Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
