I've tweaked our settings and are testing the following. Anyone have any feedback either way on why any of this is too high, too low, would let too much past, or would create too many false positives?
ORBZIN ip4r inputs.orbz.org 127.0.0.2 5 0 ORBZOUT ip4r outputs.orbz.org 127.0.0.2 5 0 ORDB ip4r relays.ordb.org * 5 0 OSDUL ip4r relays.osirusoft.com 127.0.0.3 5 0 OSFORM ip4r relays.osirusoft.com 127.0.0.8 5 0 OSLIST ip4r relays.osirusoft.com 127.0.0.7 5 0 OSRELAY ip4r relays.osirusoft.com 127.0.0.2 5 0 OSSMART ip4r relays.osirusoft.com 127.0.0.5 5 0 OSSOFT ip4r relays.osirusoft.com 127.0.0.6 5 0 OSSRC ip4r relays.osirusoft.com 127.0.0.4 5 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 10 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 5 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 5 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 5 0 BADHEADERS badheaders x x 3 0 MAILFROM envfrom x x 8 0 PERCENT percent x x 10 0 REVDNS revdnsexists x x 3 0 ROUTING spamrouting x x 5 0 SPAMHEADERS spamheaders x x 3 0 ... WEIGHT10 weight x x 10 0 WEIGHT13 weight x x 13 0 WEIGHT10 WARN WEIGHT13 DELETE --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
