@ebay.com .ebay. @hotmail.com .hotmail. @verizon.net .verizon. @yahoo. .yahoo.
When you include the @, it will prevent the test from picking up the VERP stuff, which can be problematic, especially when you have E-mail forwarded by a place like Yahoo to a local account and something with VERP comes in. An example of VERP might look like the following:
X-Declude-Sender: [EMAIL PROTECTED]
X-Note: This E-mail was sent from mx.verizon.net ([216.40.33.45]).
(note: this is fake info)
If you excluded the @ and just had "yahoo.com" in the first column, it would produce a false positive on this message because the search works as a MAILFROM CONTAINS and then REVERSE DNS CONTAINS. When you include the @ symbol, you limit the potential of a false positive with this test, in this case, only "@verizon.net" would hit, and that would match ".verizon." If you have your own domains listed in SPAMDOMAINS, you will see a lot of this VERP stuff failing SPAMDOMAINS unless you include the @. In the REVDNS column, I listed the domain without the TLD just in case they ever make a change to their SMTP domain, even if it is all from yahoo.com currently. Setting the test up this way also will require you to have two columns for each entry no matter what because the default SPAMDOMAINS functionality will try a match for REVDNS on both columns and you can't have an @ symbol in a domain.
Another note about how I have things set up. If you notice, I listed "@yahoo." without the domain extension. I did this because Yahoo has many domains for ccTLD's, so that broadens the test a bit and I'm pretty confident that they all use the same reverse DNS domain architecture. For the most part, it's probably safer to limit things in the first column as much as possible, and make the second column as broad as possible because false positives are very unfortunate.
I've been testing SPAMDOMAINS in this manner for about 3 days now with absolutely no false positives on 1,305 catches so far. Almost all of those hits have been on just a few lines. I plan on adding all of the ISP's that are suitable and over 500,000 customers or so, as well as the popular and reverse DNS verifiable free E-mail providers. Unfortunately, because I spent so much time writing filters of other types, SPAMDOMAINS only resulted in failing 18 out of those 1,305 that would have otherwise passed, or as a percentage 1.4% of hits. I've been scoring at 60% of fail weight, and every hit on this test ended up failing, and only two scored at 120% of my fail weight or below. So if you have a lot of other filters going, you might want to weaken SPAMDOMAINS a little just in case you continue to see some false positives. Here's the brunt of my list. When I'm further down the line, and have done more testing, I will share the complete file.
@yahoo. .yahoo.
@yahoo-inc.com .yahoo.
@hotmail.com .hotmail.
@msn.com .hotmail.
@aol.com .aol.
@earthlink.com .earthlink.
@microsoft.com .microsoft.
@cox.net .cox.
@t-online. .t-online.
@t-dialin.net .t-online.
@wanadoo.fr .wanadoo.
@netscape.net .aol.
@netscape.com .aol.
@amazon.com .amazon.
@apple.com .apple.
@att.net .att. @att.com .att.
@attbi.com .attbi.
@bellsouth.net .bellsouth.
@charter.net .charter.
@juno.com .untd.
@verizon.net .verizon.
@verizon.com .verizon.
@cgocable.ca .cgocable.
Matt
Sheldon Koehler wrote:
Ebay and greeting card companies fail the SPAMDOMAINS test on a regular basis. Since they also fail the nopostmaster and noabuse and a few other small ones, this adds up to a reject.
Any suggestions on keeping these false positives from happening? Christmas is coming and the E-cards are going to get real busy again...
As Matt has demonstrated with his wonderful filters, is there a good way to set up and AntiSpamdomains test?
Sheldon
Sheldon Koehler, Owner/Partner http://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support!
"Whenever you find yourself on the side of the majority, it's time
to pause and reflect." Mark Twain
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
