On 2011/03/29 1:41 AM, Ned Slider wrote:
On 28/03/11 23:44, Daniel McDonald wrote:
I just got a spam that scored relatively low (mostly due to
DNSWL_MED).
It looks like I've been getting these as well, with all being relayed
through messagelabs. Apparently, messagelabs has something broken
and/or the DNSWL listing needs adjustment. However, they are being
caught here by SaneSecurity sigs in clamav.
NSL_RCVD_FROM_USER=1.226,
Personally I score this rule way up and would have no hesitation with
outright blocking at smtp level - it's as good an indication of spam as
I've ever seen. Scoring at 6pts here and never seen a FP.
My logs agree. The only messages this rule hit on which were under my
reject threshold of 10 have been this series and is due to the DNSWL
listing. I'll be bumping up the score to avoid the DNSWL/messagelabs
error and ensure a Bayes autolearn. Thanks for pointing it out!
--
/Jason
