RE: [Declude.JunkMail] DUL skipping was ISBLANK is blank

[Markus Gufler]

Matt   I understand the logic and I think it can be very usefull for certain IP Blacklist a having relative high FP rate.   From my reports I can see that XBL has had a FP (or "wrong result") in the last 14 days and 123000 messages only in 54 cases. This is a very low FP-rate.   But there are other tests like FIVETEN-SRC that has had a wrong result in the same range for 9100 messages. The question is if FIVETEN-SRC allows a %IP4R% lookup.   Markus     From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Friday, May 14, 2004 10:30 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank Bill, The value is in scoring the last hop hits higher than prior hop hits.  In this case, a hit on XBL for the last appropriate hop (not IPBYPASSED) would result in 8 points (6 + 2), while a hit on a prior hop would result in just 2 points.  Note that the number of false positives is much higher with prior hops on tests that populate from spamtraps or are designed to detect open relays.  Tests like SBL and other static spam source tests have very little danger in scoring the same for every hop, though SBL will sometimes list spam zombies that are unresolved for periods of time (I wish they didn't do that). Matt Bill Landry wrote: ----- Original Message ----- From: "Matt" <[EMAIL PROTECTED]> XBL(LAST) dnsbl %IP4R%.sbl-xbl.spamhaus.org 127.0.0.4 6 0 XBL(ALL) ip4r sbl-xbl.spamhaus.org 127.0.0.4 2 0 Scott/Matt, would a configuration like above require multiple DNS queries since the hostnames defined in the tests are no longer identical? Or is the variable (in this case "%IP4R%") ignored in the hostname, so that as far as Declude is concerned, the hostnames are still identical? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================