On Mon, Feb 23, 2004 at 05:54:53PM -0000, Randal, Phil wrote: > I'm starting to think that only spammers uses the following sorts of > headers: > > X-AntiAbuse: This header was added to track abuse, please include it with > any abuse report
My Bayes decided to begin with that it was a strong ham signal. Unfortunately spammers then started using it, so I set "bayes_ignore_header X-AntiAbuse" in local.cf. I did the same for X-Auto-Submitted. It normally only occurs on bounces, but bounces can be very hammy if they don't have the spam text in, so it had a lot of counts (some tens of thousands) and a very low score. In fact bounces often seem to score very hammy even if they do have spamtext, because they lack the normal clues in the headers. They would therefore get a wopping BAYES_00 -4.9 on account of the strong header signs, a piddly +2.4 or so from the content, and whiz straight through. I'd like to suggest both these changes be incorporated in stock SA (2.64 or 3.0) - I've found them very worthwhile in preventing either deliberate misuse (X-Antiabuse) or accidental (X-Auto-Submitted). Nick
