>> On 05.08.09 00:31, Martin Gregorie wrote: >>> If, for some (very) odd reason you run greylisting after SA then *of >>> course* your host has (a) seen the mail and (b) passed it through SA. >>> How else can the mail get to the greylister? >>> >>> Would you care to explain why you put a greylister behind SA? Do you >>> know how a greylister works and why it was designed to work that >>> way?
> Matus UHLAR - fantomas wrote: >> He already explained that he greylists only mail that scores above a limit. On 05.08.09 10:15, a...@exys.org wrote: > exactly. The point is that scores below 2 are never spam, so i avoid > greylisting. Thats my whitelist (you usually need for greylisting) at > the same time, since i whitelist some hosts in SA. > >> In that case we can assume the spam scored high even before so it got >> greylisted. In such case I doubt it was learned as ham, unless the >> greylisting check is broken... > above 2. The njabl hit would have been enough to hit that. It didn't > score above 10, because that would have been rejected at smtp time. > > My guess is that it scored 2 on the first try, then later it would have > scored above 10 due to surbl listings, but awl kicks in and lowers the > score thinking the greylisted mail was an independent message. that's it! you can look at spamd logs and search for the same message-id. >>> And where else did greylisted mail appear in the log? For the >>> mail to be logged as rejected by a greylister *after* its been >>> through SA it must also have been inspected by AWL and therefore it did >>> affect the AWL database. > oh right, i could look at the SA log, but i already know it passed SA 3 > times. while repeated learning of the same message does not affect bayes, I think this doesn't apply for AWL. >> the question is, why it scored hammy? aep, how did it score before >> greylisting? Are you sure you do not have bug in your greylisting code? > see above. i'm pretty sure the "bug" is passing the same message to SA > multiple times. >> Btw, I'm not sure if it should not be low scoring messages (spams) for which >> greylisting is very good, since you won't become that early recipient... > 2 to 5 is the sweetspot. That message in question actually proved it is > working, since the URIBL hits came later. Then it scores >10 so it gets > rejected. > I think that setup is fairly smart, excluding the problem that i train > SA with wrong information. > > I wonder if i could ask SA to score a message without learning it, > although exim-sa propably doesnt support that. turning off AWL and autolearn (optionally only when run at SMTP time) would help you here. Although using such setup you loose much of advantages (like AWL ;-) and especially personalising... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. "The box said 'Requires Windows 95 or better', so I bought a Macintosh".
