"Dennis B. Hopp" <dh...@coreps.com> writes: > I received the following e-mail > > http://pastebin.com/JXr9buxi > > It had a total score of 4.973 (blocked at 5). Among other rules it hit: > > KHOP_RCVD_TRUST=-1.75,RCVD_IN_DNSWL_MED=-0.5,SPF_PASS=-0.001 > > So is the KHOP_RCVD_TRUST score too low? Should I possibly consider > making that -0.75 or something? Is there a way to report FP to KHOP?
I don't think it's not a KHOP FP, but a DNSWL FP. If you got spam from a DNSWL MED listed host, by all means report it to adm...@dnswl.org. KHOP_RCVD_TRUST, is supposed to lower the score of a mail that is DKIM signed or passes SPF hits a whitelist doesn't hit lots of whitelists I suggest reading the rules to really be clear on it. I don't really understand why this is a good idea; most if not all of the whitelists are based on the IP address of the sender. I get spam From whitelisted hosts all the time (facebook is particualrly bad), but spf/dkim won't help - the spam really is from them. I hadn't really paid attention to this before, but I just changed the score (leaving it non-zero so I'll notice it on FPs and perhaps reconsider - I filter to spam filter at 1 point). score KHOP_RCVD_TRUST -0.1
pgpBe1igI10Fc.pgp
Description: PGP signature
