Hi, On Mon, May 16, 2016 at 9:15 AM, RW <rwmailli...@googlemail.com> wrote: > On Sun, 15 May 2016 20:58:41 -0700 (PDT) > John Hardin wrote: > >> On Sun, 15 May 2016, Alex wrote: >> >> > Is that score really warranted? For example: >> > >> > Received: from host82.torus.pl (91.209.116.82) (HELO [192.168.20.7]) >> > by sedan1.home.pl (89.161.160.215) with SMTP (IdeaSmtpServer >> > v0.80.2) id 74a9561edc57ecb3; Wed, 11 May 2016 09:57:10 +0200 >> > >> > It appears to be triggered based on the "home" in the hostname? >> > >> > What was the intention of this rule? To catch mail with "home" in >> > the HELO string? >> >> A HELO that ends with ".home", regardless of the hostname. Your >> example above should not have hit that rule. > > It only require a boundary after "home".
Have we looked at some of the other FSL_ rules? Do we have any reason to believe they may also be scored to high or disproportionately tag ham? I've seen a significant number of FSL_HELO_BARE_IP_2 also hitting a lot of ham, and just wanted to make sure, with such a high score, it was also not FP prone...
