I've just had another couple of reports of false positives due to hits on one or more of the FROM_MISSP_* rules.
Curious coincidence: Almost all of the reports to date have involved webform email for real estate companies. Most of the rest have involved scan-to-email multifunction devices - mostly Xerox.... used by real estate companies. O_o It's become enough of a problem that I've sighed, rolled my eyes, and disabled the scored rules in this cluster, since they're also not making much of a difference in spam catch rate locally. (They're hitting as much as ~3% of mail scanned daily, but only making the difference between ham and spam on ~10-15 of ~80-90K messages daily - including an unknown number of FPs that don't get reported.) While I agree that this is triggering on a real RFC-"SHOULD" structural problem with the emails, it's clear that people writing webform handlers and people writing email code for multifunction printer/scanner devices don't see this as a problem. I've tried contacting several websites offering services to real estate agents, for instance, and I have had no response. -kgd
