From: "Marc Perkel" <[email protected]>
Sent: Tuesday, 2010/February/02 14:48
Mark Martinec wrote:
On Tuesday 02 February 2010 18:53:35 Marc Perkel wrote:
If you are worried about losing good email add this rule to your
ruleset:
header RCVD_IN_HOSTKARMA_W eval:check_rbl_sub('HOSTKARMA-lastexternal',
'127.0.0.1') describe RCVD_IN_HOSTKARMA_W Sender listed in
HOSTKARMA-WHITE
tflags RCVD_IN_HOSTKARMA_W net nice
score RCVD_IN_HOSTKARMA_W -5
This is a white list and it is very extensive. It will protect a lot of
your ham while blessing very little spam. So if you are ham oriented,
not losing good email, this is a list that will work for you.
We received 52 spam messages per day on the average in January
which got a hit on RCVD_IN_HOSTKARMA_W. Luckily we only score
it at -0.5 . Of these 52 spam messages, 3.6 messages per day
would have been treated as ham had we used a rule score -5
and required_hits 5.
Examining messages that were blocked but whitelisted by
RCVD_IN_HOSTKARMA_W, I found four newsletters in the whole
January (not per day), each sent to avg three of our recipients,
which could potentially be worth saving. None of them were
worth rescuing from a quarantine.
In summary, score of -5 for RCVD_IN_HOSTKARMA_W is grossly overrated.
Mark
Mark, I think you are missing the important point. This user is more
interested in getting good emails than rejecting spam. It's a different
value system than yours. You have to understand it in terms of getting
ham rather than rejecting spam.
You have a good point there, Marc. An ISP that has many users few of
which even bother to check the spam mailbox which doesn't offer efficient
tools for review might find your whitelist more useful than a group of
people who get the opportunity to review a spam score ordered spam mailbox.
I can scan mine in moments. Scores over 10 are VERY seldom ham, one a year
perhaps. And as it happens few spams here score under 10 of late. So review
is about 2 or 3 minutes plus time to feed them to the Bayes training
repository I have for hams and spams in case I need to restart my Bayes
training processes.
That way I appear to miss nothing *I* consider ham by title or sender.
And yet I waste very little time a day even if I have a couple hams to
pull out of the spam box some days. (Even one is unusual of late.) So
that's a rate of about .1% mis-identified ham and .01% mis-identified
spam.
For those who wonder this is one of my user defined rules I use.
"rewrite_header Subject *****SPAM***** _SCORE(00)_ **"
I like the way that automatically alphabetically sorts spam by score in a
three digit range.
It seems the utility of your rule depends on how savvy those receiving
the mail might be. I'm lucky with only two users both of whom are
reasonably clever in this regard.
Mark, for you, perhaps -5 is overrated. It's adjustable. Given Marc's
rationale for the score I can see it's utility in some situations. As
with any score, when you identify it as a problem, readjust its score.
That is what your local .cf file(s) are for, ya know.
{^_^}
{^_^}
