Hi Michael, thank you for your quick reply.
For example, this is a report for a mail tagged as non spam:
Content analysis details: (3.4 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5012]
4.0 BOUNCE_MESSAGE MTA bounce message
4.0 ANY_BOUNCE_MESSAGE Message is some kind of bounce message
-4.6 AWL AWL: From: address is in the auto white-list
Its a bounce message, a forgerie. I'm using VBounce to catch this messages
(works well), but increasing the score assigned for this rules
(BOUNCE_MESSAGE and ANY_BOUNCE_MESSAGE). The score without AWL would be 8,
spam, but with AWL test: 3.4. Result: Non-spam. :_((
I didnt know anything about AWL was deprecated. So, in your opinion, what
could
be a good solution for this mess?
Thank you so much.
Antonio.
2012/2/21 Michael Scheidell <[email protected]>
> On 2/21/12 10:11 AM, Antonio Gutiérrez Mayoral wrote:
>
>> rule AWL is triggered with a negative score. Reading the documentation I
>> think that the problem
>> was a wrong auto-learn thresold for HAM, the first week the system starts
>> to work. The initial
>> thresold for Ham was -0.001 and I think that this thresold causes a lot
>> of spam and backscatter addresses
>> was learned as non-spam addresses. Could be possible?
>>
>> and, this is one reason why awl is deprecated, and disabled by default
> in all new SA installations for (2 years? someone correct me on the time?)
>
> Q: if you did not have that negative score, would you have marked those
> emails as spam? if answer is yes, disable AWL.
>
> also, since you are using amavisd-new, you might want to ask specific (non
> AWL) questions on their mailing list about backscatter. they have a
> solution that might work better than AWL.
>
> --
> Michael Scheidell, CTO
> o: 561-999-5000
> d: 561-948-2259
> >*| *SECNAP Network Security Corporation
>
> * Best Mobile Solutions Product of 2011
> * Best Intrusion Prevention Product
> * Hot Company Finalist 2011
> * Best Email Security Product
> * Certified SNORT Integrator
>
> ______________________________**______________________________**__________
> This email has been scanned and certified safe by SpammerTrap(r). For
> Information please see http://www.spammertrap.com/
> ______________________________**______________________________**__________
>
--
--
Antonio Gutiérrez Mayoral <[email protected]>
