At 01:53 AM 6/6/2005, Roman Volf wrote:
I recieved a spam (http://www.keystreams.com/~volfman/spamd-msg.txt - I
stripped the X-Spam headers from the message) that only scored a 4.4,
even though the URIDNSBL showed a hit.
Here is the debug from spamd -
http://www.keystreams.com/~volfman/spamd-debug.txt
Is upping the score that a URIDNSBL hit gives a good idea? I mark spam at
5.0. Is this possible?
Any suggestions?
To be specific, that's URIBL_SBL.
Let's look at the mass-check results for this test:
20.829 42.0571 0.7080 0.983 0.42 1.00 URIBL_SBL
It's got a S/O of 98.3%, which means that 1.7% of the email that rule hits
is nonspam. You could probably raise the score a little bit safely.
However, because the FP rate is low but not insignificant but I would be
careful and not go over 2.0 with it.
As someone else suggested, adding the uribl.com tests would also be
helpful, but it's hard to say if uribl.com had that link listed at the time
you got the message. SURBL lists the domain in AB, OB, SC and WS now, but
none of them had it before. However, the more checks you use, the more
chances you'll be checking the list that got it reported first.
p.s. the SA list moved off incubator a long time ago (Although the address
does still work, and probably will indefinitely, the current "real" address
is users@spamassassin.apache.org)
