Rob Mangiafico wrote:
Spoke too soon on the false positives. Had it hit an ebay and amazon email
for a user. Headers below:
Thoughts?
Some configuration might be in order.
Since the plugin is very new you should probably give it some time before
considering the default config anywhere near optimal. :-)
Received: from mx29.sjc.ebay.com (mxpool14.ebay.com [66.135.197.20])
by XXX (8.11.6/8.11.6) with ESMTP id kAS2PGV00414
for <XXX>; Mon, 27 Nov 2006 21:25:16 -0500
Put "mxpool" in botnet_serverwords or remove "pool" from botnet_clientwords?
Received: from smtp-out-4101.amazon.com (207-171-180-184.amazon.com
[207.171.180.184])
by XXX (8.11.6/8.11.6) with ESMTP id kAS2XrV04185
for <XXX>; Mon, 27 Nov 2006 21:33:53 -0500
This was ugly, but you could put "amazon\.com" in botnet_serverwords to avoid
it.
Or you could just trust SpamAssassin scoring to work as intended in this case.
:-)
(A false positive by *one* rule should never result in a false positive for the
mail unless that one rule is very discriminating.)
Regards
/Jonas
/Jonas
--
Jonas Eckerman, FSDB & Fruktträdet
http://whatever.frukt.org/
http://www.fsdb.org/
http://www.frukt.org/
