>...
>That's where the human tweaking is supposed to happen; if gobs of spam
>flag the 80% meter of some test while no ham does, and the 90% meter is
>almost never hit by anything, it should have a higher value than the 80%
>meter does. If the 90% meter has more ham than spam despite the 80% meter
>having more spam than ham, the tests need to be closely looked at rather
>than inappropriately weighted.
>
>just my two cents, anyway
>
>-Adam Katz
>
Here one of your own examples pops up - SPF_FAIL vs. SPF_SOFT_FAIL.
In the current state of the world, *most* "soft fail" results are actual
forgeries, but *most* "hard fail" results are administrator or user error.
So SOFT_FAIL is a "better" spam sign than FAIL - often these things can
and do make sense when a rational explanation is looked for (but it can be
very far from obvious at time). Hopefully as administrators learn, things
like SPF, DK and/or DKIM will become more useful ("~all" and "sign some" are
both serious dilutions of what the technologies has to offer).
Paul Shupak
[EMAIL PROTECTED]
