> Out of 1829, 37 SPAM messages failed POPULARDOMAINS. That is about 2%. > Out of 1829, 26 valid messages failed POPULARDOMAINS. That is > about 1.4%. I am not including the 4 that you have changed > the configuration for.
I'm not sure if you understand was I mean. I think that it's absolutely not important how much of the total in processed messages catched the POPULARDOMAINS test. It's important how much messages more are now hold. So you can say that with 16 messages more from 102 there was an increase of around 15%. > The ratio of positive to false positive is about 1.4 to 1. Why? There was 5 false positives using the wrong domain listings (without the @) With this new settings there is one single false positive. > If you can explain how you come up with that analysis, I > would be willing to do that here. It's simple if you have not too much msg/day. Open your declude log file (MID level) and search with F3 for "POPULARDOMAINS " (note the space at the end) So you will stop one time per message that triggered this test (in my case it was 67 times) and you can see very fast if this message is spam or not. ok, I should explain that on our server 90% of all messages are written or in German or Italian language, so it's very easy to understand if a msg is spam or not. I'm sure other people here can confirm that scrolls trough the hold list in spam review and understand immediately if a message is spam or not. Anyhow there was no msg from this 67 where I wasn't sure. Now its very simple to count If the weight is exactly at 70% there is all right, it has triggered NOABUSE, NOPOSTMASTER and POPULARDOMAINS If the weight is between 100 and 140% the message at first was not catched without POPULARDOMAINS but now yes. If the weight is over 140% POPULARDOMAINS has had no influence. The spam was already blocked. During normal working hours neither I have time to make stats like this. Here in Italy it's 11:30 PM and I have to wait until I can get my sister from the railroad station. :-) Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
