On 2025-01-15 at 04:21:41 UTC-0500 (Wed, 15 Jan 2025 10:21:41 +0100)
Matus UHLAR - fantomas <uh...@fantomas.sk>
is rumored to have said:
It seems that RCVD_IN_MSPIKE_H2 is the only one that produces
significant score:
50_scores.cf: score RCVD_IN_MSPIKE_ZBI 2.7
50_scores.cf: score RCVD_IN_MSPIKE_L5 2.5
50_scores.cf: score RCVD_IN_MSPIKE_L4 1.7
50_scores.cf: score RCVD_IN_MSPIKE_L3 0.9
50_scores.cf: score RCVD_IN_MSPIKE_H3 -0.01
50_scores.cf: score RCVD_IN_MSPIKE_H4 -0.01
50_scores.cf: score RCVD_IN_MSPIKE_H5 -1.0
50_scores.cf: score RCVD_IN_MSPIKE_BL 0.01
50_scores.cf: score RCVD_IN_MSPIKE_WL -0.01
72_scores.cf:score RCVD_IN_MSPIKE_BL 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_H2 0.001 -1.794 0.001 -1.794
72_scores.cf:score RCVD_IN_MSPIKE_H3 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_H4 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_H5 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_L2 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_L3 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_L4 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_L5 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_WL 0.001 0.001 0.001 0.001
72_scores.cf:score RCVD_IN_MSPIKE_ZBI 0.001 0.001 0.001 0.001
On 15.01.25 09:23, Bill Cole wrote:
It is worth noting that the 72_scores.cf file is what the RuleQA
process produces. I haven't dug into the details, but it looks like
Mailspike is ONLY really useful at the H2 level.
that's possible, but according to https://mailspike.io/ip_verify/usage
H2 is supposed to be indication of "Possible legit sender"
50_scores.cf should be generated by mass-checking, where H2 generated no
score (why?)
and yet, H2 has more significant score that what mass-check generated
L5 (excellent reputation) which should be stronger indicator of hamminess.
Does it make sense to use this WL with this score?
That has to be a local question.
This is what I'm curious about. Of course I can locally increase the score
locally.
For the people going to the trouble of submitting human-classified ham
and spam results to RuleQA, RCVD_IN_MSPIKE_H2 was a fairly strong
indicator of non-spam. So it makes sense IF your mailstream looks a
lot like that of the submitters. Sadly, mailstreams vary a great
deal, so no individual site is likely to match the non-random sample
that we have access to.
should I assume that RuleQA works with different corpus than masscheck?
I don't think the listing of behemoth sources as "good-ish" is wrong
per se, because many sites can show that they get more ham from GMail
than spam. MS is a somewhat different story, because they try to
segregate their suspect mail to a subset of output points. If your
mail does not include much GMail ham, it may make sense to set the
scores locally. E.g. I have:
/etc/mail/spamassassin/local.cf:score RCVD_IN_MSPIKE_H2 0.2
/etc/mail/spamassassin/local.cf:score RCVD_IN_MSPIKE_H3 0.1
Those are based on careful analysis a few years ago, so I can't even
be sure that they make sense for me today, but they certainly are not
causing visible trouble,
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Christian Science Programming: "Let God Debug It!".
