On 07/07/2017 11:29 PM, Bill Cole wrote:
On 7 Jul 2017, at 13:04, Alex wrote:
I'm interested in how your system would have (or currently does)
handle this email I received some days ago:
https://pastebin.com/innRFvZt
Its IP (106.186.119.240) is still not listed with spamhaus, sorbs or
hostkarma, and has an 83 rating with senderscore.
This never would have made it to SA on most systems I have recently
managed:
1. Null sender with From & Subject both inconsistent with DSN or other
legit null-sender mail.
Yes. My MTA would have never accepted this email either. I manually
ran it through SA to see how it would have scored.
...
My personal SA would have rejected it because:
1. I don't trust BAYES_00 as much as masscheck because a lot of my ham
describes or includes spam.
2. I have FROM_EXCESS_BASE64 pegged to 2, originally because it was too
high and had FPs, now because masscheck scores it too low.
Good point. I have checked my hits on this rule and bumped up the score
too. Hopefully my work on the masscheck system will improve this score
once I am able to figure out the current problem and we resume score
updates again. I am working on this issue again this morning for a few
hours.
--
Dave
