I weight CMDSPACE at 40 (subject tag at 100, hold at 200, delete at 300).
I show about a 3% false positive rate which includes some list servers. Also
seems to tend combine with helo-bogus and spamheaders hits.
It did detect 43% of all spams here.
I don't use comments...
----- Original Message -----
From: "Kevin Rogers" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, August 24, 2005 10:44 AM
Subject: [Declude.JunkMail] CMDSPACE
A little while back I wrote about how BADHEADERS and HELOBOGUS were
catching a lot of legit email. The same is true of CMDSPACE and COMMENTS.
This is what it says at declude.com
CMDSPACE:
The CMDSPACE test looks for a technical violation of the RFCs. This test
works very well because it catches about half of all spam, while no
legitimate mail servers fail this test. The one drawback is that some mail
clients will fail this test, so the test is most useful if you whitelist
your own users (see the "WHITELIST AUTH" option), or do not have very
strict anti-spam settings.
COMMENTS:
The COMMENTS test will catch spam that uses HTML comments to bypass
filters. It is a very effective test, since it will not catch standard
comments that occasionally appear in legitimate bulk mail; it only catches
comments that are designed to bypass filters.
My users get a lot of legit emails that get flagged with both these and
then end up with a weight of 12 and get put in their bulk folder. I mean
a lot. Just regular emails sent from Aetna.com, Principal.com, other big
insurance carriers. Should I reduce the weight of them? Are they working
like they should? Anyone else see this a lot?
Thanks
Kevin
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
