Jeremy Morton wrote: > I've suddenly started getting a new slew of spams that are making > their way through my SpamAssassin filter. Here's an example of one: > > http://pastebin.com/m586e296c > > As you can see they tend to hit a couple of blacklists, but don't get > a high enough score to be marked as spam. What do your SpamAssassin > analyses give of this e-mail, and any tips as to how I can get these > marked as spam?
I highly recommend scoring RDNS_NONE at much higher than "0.1", and scoring RCVD_IN_PBL at much higher than 0.9 If you don't feel comfortable having these combine to score higher than threshold, then consider bumping each of these up at least by a whole a point or two... and then add a metarule that might add an additional point or two if BOTH of these have been triggered. An occassional legit e-mail will have RDNS_NONE, and an occassional legit e-mail will have RCVD_IN_PBL. But even extreme fewer legit emails will have hits on BOTH of these. So I'd suggest scoring the combination of the two either just above threshold, or (at the least...) just below threshold. -- Rob McEwen http://dnsbl.invaluement.com/ r...@invaluement.com +1 (478) 475-9032
