Hi Team, I was wondering what folks were doing with SPF_FAIL , TO_EQ_FM_SPF_FAIL and TO_EQ_FM_DOM_SPF_FAIL these days?
I personally have never seen an FP with any, but understand from the reading I've done that some people do. My approach has always been to combine with DCC/Pyzor/Razor hits in a Meta rule, but we've recently started seeing mail just squeak under the fence using this approach ... particularly some of the 'nicer' Bank Spam. The temptation is to add Bayes to the Meta. Is this a bad idea, or does anyone have any better suggestions? We're running SA version 3.3.2. Sadly, upgrading to 3.4 isn't an option at this stage. Thanks for your time & wisdom Judy.
