Hi, Was wondering if could have some advice, and I probably know what I'm going to do anyway, just wanted a few others opinions..
I've been analysing a load of mail which is having it's SA score reduced by what looks like paid for whitelists. A view of the SA scores I'm seeing is: Rule Total Ham % Spam % RP_MATCHES_RCVD 161,165 142,559 88.5 18,606 11.5 RCVD_IN_RP_SAFE 22,405 22,399 100 6 0 RCVD_IN_RP_CERTIFIED 22,130 22,125 100 5 0 RCVD_IN_RP_RNBL 12,794 43 0.3 12,751 99.7 T_RP_MATCHES_RCVD 7,080 5,072 71.6 2,008 28.4 Now looking at virtualls ALL of these they look like SPAM. Now the scores for this GASH are as follows: RP_MATCHES_RCVD -2.023 -1.201 -2.023 -1.201 RCVD_IN_RP_SAFE 0.0 -2.0 0.0 -2.0 RCVD_IN_RP_CERTIFIED 0.0 -3.0 0.0 -3.0 RCVD_IN_RP_RNBL 0 1.284 0 1.31 For some reason I can't find any scores for T_RP_MATCHES_RCVD. Am I being dumn here? Does the T_ mean something I don't know? So anyway, what I recon I should do is get rid of all the negative scores for these Rules, as looking at the scores above, they are all suspicious, and looking at the actual mails, they are pretty dodgy. Has anyone else seen this or got any advice on this matter? Should we be trusting a paid for whitelist? I also saw something about fake RP headers? Could this be the case? Thanks Pip (Apologies have posted same to mailing list but thought I'd try a 2 pronged approach!) -- View this message in context: http://old.nabble.com/Return-Path-Whitelists%2C-RP_SAFE%2C-RP_CERTIFIED%2C-RP_MATCHES%E2%80%8F-tp32870476p32870476.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
