From: "Chris St. Pierre" <[EMAIL PROTECTED]>
On Tue, 24 Oct 2006, Juan Mas wrote:
Im looking to change scoring in my SA setup. As it stands now, we know
mostly what e-mails and from who we will be receiving to our system that SA
is monitoring. Id like to make our scoring a bit more strict. Right now
Ive got spam being flagged at required score 1, and I still have a good 20%
coming through the system. Can anyone point me to where I can go about
changing the rules scoring?
I don't think we'd get any mail if we set our score to 1. :)
Are you using network tests and the SARE rulesets?
Also, are you using a reasonably well-trained Bayes? If you know what
kind of mail you'll be getting, it should be easy to construct a
corpus -- and then crank up the scores for the higher Bayes percentages.
Still, I can't help but wonder if there's some sort of
misconfiguration. What spam sneaks through our system tends to be
scored in the 3-4.9 range -- i.e., just below our threshold of 5. I
see _very_ few reported false negatives with a score below 2 or 3.
He should also look for ALL_TRUSTED in his logs or message markups. If
it's there he has a toasted setup and needs to fix his trust (as in only
trusted not to forge headers) arrangements. He should visit the WIKI to
learn more about this common problem.
{^_^}
