Hi John, With my settings at the moment a mail from one off this popular domains will have a "default value" of 70%
40% POPULARDOMAINS 15% NOPOSTMASTER 15% NOABUSE Now I asume that no real message from this domains will trigger a junkmail test that is heavy weightet (BASE64, BADHEADERS, SPAMCOP and other OR-DB's, ...) "heavy weighted" means more then the remaining 30% to the hold value. Yes, I know now it's possible that a mail from this domains can be more easily trigger the sub.modification action. But this action for me has not much value: Real spam that passes my filters is allready delivered and our clients have to delete it manualy. There is no difference if the unwanted messages has a modificated subject line or not. On the other side it's not so problematic if a real mail is marked in the subject as possible spam. It's importand that it arrives and it's not hold or deleted. I don't see any reason to keep the sub.modif. action or at least I will set them over the 40+15+15% value. Again I'm open for any rectification. Markus > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of John > Tolmachoff > Sent: Monday, December 09, 2002 4:19 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Populardomains test > > > >I'm missing something that could trigger false positives? > > What if I send you a note from my yahoo.com account that just > happens to trigger one of your filters because I am telling > you about a new spam technique? > > With the way you have it set, just me sending a mail to you > from my yahoo.com account is now at 55% (or is that 70% if > abuse is 15% and postmaster is 15%) of your hold weight. > > While I am also testing for those domains, I have that > combination (total if it fails domain, abuse and postmaster) > at 50% of subject modification and 40% of hold. > > Just my .02. > > John Tolmachoff MCSE, CSSA > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
