Stefan Jakobs wrote: > Hello list, > > one of my users received this message: > http://pastebin.com/m2d3ad435 > > and it scored like that: > X-Spam-Status: Yes, score=12.501 tagged_above=-999 required=5 > tests=[BAYES_00=-2.599, DATE_IN_PAST_12_24=0.992, EXTRA_MPART_TYPE=1, > HTML_MESSAGE=0.001, INVALID_DATE=1.245, MIME_QP_LONG_LINE=1.396, > MY_CID_AND_ARIAL2=1.46, MY_CID_AND_CLOSING=1.6, MY_CID_AND_STYLE=1.54, > MY_CID_ARIAL2_CLOSING=1.63, MY_CID_ARIAL_STYLE=1.58, > PART_CID_STOCK=1.635, SA2DNSBLC=0.001, T_TVD_FW_GRAPHIC_ID1=0.01, > URI_SPACE=1.01] > > 12.5 points is a lot. And again the message was from VDE and 70_sare_stocks > hit at it. Is 70_sare_stocks still useful? > > My rankings from today: > %4.38 MY_CID_AND_STYLE=1.54 > %2.89 MY_CID_AND_ARIAL2=1.46 > %2.89 MY_CID_ARIAL_STYLE=1.58 > <%1.0 MY_CID_AND_CLOSING=1.6 > <%1.0 MY_CID_ARIAL2_CLOSING=1.63 > > I suppose the problem is that MY_CID_ARIAL_STYLE is a subset of > MY_CID_AND_STYLE. Also is MY_CID_ARIAL_STYLE a subset of MY_CID_AND_ARIAL2. > And MY_CID_AND_CLOSING is a subset of MY_CID_ARIAL2_CLOSING which is a subset > of MY_CID_ARIAL_STYLE. > > That seams complicated. I try to present it in some kind of a tree: > MY_CID_AND_STYLE MY_CID_AND_ARIAL2 MY_CID_AND_CLOSING > | | | > +---MY_CID_ARIAL_STYLE---+---MY_CID_ARIAL2_CLOSING---+ > > > So, if one of the rules in the second level fire, then at least two other > rules will also fire and the message get approx. 4.5 points. Isn't that too > much?
Yeah, you might want to take that up wit the SARE guys. That rule is from 70_sare_stocks.cf, not an official SA ruleset.
