Cedric Knight wrote: > > 1) About a year ago, SpamCop seemed to be the single most > useful test, catching a majority of spam with few of the > reputed false positives. > A weighting of 3.0 seemed right. In the past 2 or 3 months, > the proportion of spam marked by SpamCop seems to have > fallen, and there may be a few more false positives. Has > anyone else noticed this, or have an explanation for it? > Could it be the Perl or SA config, or just my imagination?
Spamcop is not the most trustworthy of DNSBLs to test against. The number of false positives can be very high. If you are looking for a good DNSBL have a look at http://www.uribl.com > 4) Finally, here are some primitve rules that I've found useful. > There's derived from false negatives, but I haven't checked > them against any corpus. > > header FROM_ITALIAN_DOMAIN From =~ > /@(libero|jumpy|virgilio)\.it/ > describe FROM_ITALIAN_DOMAIN From a known abused Italian domain > score FROM_ITALIAN_DOMAIN 3.0 Libero et al maybe abused, but they also have thousands of legitimate users. > This doesn't look possible using Perl backreferences. Is > there any way to do it? Have you looked at MailScanner (http://www.mailscanner.info) ? The anti-phishing tests it uses are excellent and will do what you want HTH Michele Mr Michele Neylon Blacknight Internet Solutions Ltd Quality Hosting, co-location & domains http://www.blacknight.ie/ Lo-call: 1850 927 280 Tel. +353 59 9183072 Fax. +353 59 9164239 Tired of your current host? Save 15% when you move to us!
