> ________________________________________ > From: Ian Zimmerman <i...@buug.org> > Sent: Monday, August 25, 2014 5:02 PM > To: users@spamassassin.apache.org > Subject: Re: drop of score after update tonight
> On Mon, 25 Aug 2014 19:50:20 +0000, > David Jones <djo...@ena.com> wrote: > Ian> I definitely have FNs today (about 10 by now today, normally 0). > Ian> Looks like some/all RBLs tests are not working. I have not changed > Ian> my configuration at all. > Ian> Sample here: > Ian> http://pastebin.com/dsqaVA9Z > David> This hit DCC_CHECK, BAYES_50, CRM114, BOGOFILTER and KAM_EU rules > David> and would have been blocked on my SA 3.4.0 servers. > Isn't it a bit odd that SA has rules for all these other Bayes powered > backends? Why not give a bit more weight to its own Bayes instead, > rather than make users forage for other tools that do essentially the > same thing? Based on my testing, I have found that having BAYES, CRM114, and BOGOFILTER together provides very good "checks and balances". Spammers pay "spam shops" for new spam campaigns that get through standard spam systems including SA. I have often seen new spam score low on BAYES but CRM114 and/or BOGOFILTER correctly score it as spam. So they do similar things but aren't identical. If you don't have other indicators like DCC, RAZOR, CRM114, BOGOFILTER, RBLs, etc., how else will you hit the bayes_auto_learn_threshold_nonspam and bayes_auto_learn_threshold_spam levels to make BAYES more accurate and detect new spam campaigns quickly? > David> (I understand that the DCC_CHECK hit could have also hit on your > David> mail server too after time had passed if you have DCC enabled.) > Don't you need non-free software for DCC? DCC is free for your own filtering or if you are an ISP that participates in the DCC network. We participate in the DCC network. http://www.rhyolite.com/dcc/ > (Meanwhile, more spam came in. This is definitely a crisis for me.) > -- > Please *no* private copies of mailing list or newsgroup messages. > Local Variables: > mode:claws-external > End:
