> <snip>Are you still running test mode for checks other than Bayesian?

Most but not all.  SPF hard fail, Forged HELO are not in test mode and will 
discard mail and CC to all spam with logging set to 7.

> If not, wouldn't Bayesian be the only email that you would get as ASSP 
> spam reason?  Wouldn't all the rest be rejected at source?  Or do those 
> still get copied over into the ccAllSpam address?

Depends somewhat on your settings.  I have some tests do scoring only and 
some activated.  I have Penalty Box in testmode so if an email gets a high 
PB score it gets the PB spam header but gets passed to the user.  Most spam 
gets passed to the user and a copy to my spam account for analysis.  The MTA 
then checks the user's incoming mail for ASSP reason codes and only allows 
non-spam and Bayesian-only spam to be routed directly to the user, all other 
spam goes to their spambox.

> Do you know if there is a list somewhere (wiki, docs, archives), of all 
> the different reasons that ASSP uses to flag spam?

Don't know of a list, but you are missing at the least:

X-Assp-Spam-Reason: Has blacklisted domain
X-Assp-Spam-Reason: Failed SPF checks
X-Assp-Spam-Reason: Failed URIBL checks
X-Assp-Spam-Reason: Failed URIBL checks (maximum unique domain uris 
exceeded)
X-Assp-Spam-Reason: BombHeaderRe: 'Headerlength (xxlengthxx) > 10000'
X-Assp-Spam-Reason: PB:LV1 blocked - score:xscorex (xxxreasonxxx)

> One strange / concerning thing that I am noticing, and was wondering if 
> you saw similar, is that the majority of my spam catches are all Bayesian 
> (probably close to 90%).  Which concerns me that these aren't being caught 
> elsewhere prior. If perhaps my settings are too lenient elsewhere.

Perhaps.  I get allot of spam caught by ForgedHELO, BombRe, PBLVL1, RBL, & 
URIBL.  Much of the Bayesian scored spam is actually false pos on 
newsletters and the like still.  Of all the actual spam that I am accepting 
for my users, 50% is Bayesian only and the rest is split up among the other 
tests.

> Do you also find that you need to sift through your error reports (both 
> spam, and notspam) to see if users are mis-reporting email?

I do, but my users are mostly oblivious to what I am doing for them.  There 
are only a few that I have instructed on non-spam/whitelist reporting and 
they do it rarely.  When I am ready to do so I will instruct them on the 
email interface and the false positives will likely lessen.

Doug 



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user

Reply via email to