On 9/20/2016 9:46 AM, Thomas Barth wrote:



Am 20.09.2016 um 15:27 schrieb Bowie Bailey:

X-Spam-Status: Yes, score=14.009 tag=2 tag2=6.31 kill=6.31
        tests=[HTML_MESSAGE=0.001, MESSAGEID_LOCAL=8,
MIME_HTML_ONLY=1.105,
        PYZOR_CHECK=1.985, RCVD_IN_BRBL_LASTEXT=1.644, RDNS_NONE=1.274]
        autolearn=no autolearn_force=no

The base SA ruleset is optimized to detect spam with a score of 5.0.  If
you raise that score, you will allow more spam to come through. If you
lower that score, you will see more legitimate messages blocked as
spam. Make sure you know what you are doing before you change this score.


I read that 5.0 is aggressive and suitable for single user setup, conservative values are 8.0 or 11.0.

required_score n.nn (default: 5)
https://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Conf.html


I ve checked most of the mails recognized as spam. The lowest score was 8.6x so far.

Here is another mail from ...local. It definitely was spam with zip attachment. Common is a sender address with digits. <wynn.54...@allfromboats.com> -> <tba...@txbweb.de>, quarantine: l/spam-lEHVGcheLkyq.gz, Message-ID: <20160920202635.6b90ec7...@allfromboats.com.local>, mail_id: lEHVGcheLkyq, Hits: 19.118

May be I also should block sender adresses with more than 2 digits in the name?
My experience has been that spam scoring gets error-dominated pretty rapidly outside the range near 5.0. That is to say, the difference in actual spamminess between messages scored 4 and 6 is far more predictable and significant than between -1 and 1, or 10 and 12. Even a score of 8.0 I would expect to take months of tuning to get right, between rescoring rules and RBLs appropriately and then giving the bayes thresholds accurate scores on top of that. The furthest I would probably go is 4.5 to 6.0. Outside that range, it's easy to run into unpredictable "why was this spam blocked and that spam wasn't" scenarios.

Many of the stock published rules are scored by AI, which runs an optimization problem to get the most spam on the right side of 5.0 and the most ham on the left side. For the purposes of solving that problem, the difference between a message scoring 4.8 and 4.9 is the same as the difference between 4.0 and 4.9, or -50 and 4.9. Developers smooth out the scoring curve by determining what rules the AI gets to score and for how much, but that effect is strongest where we can quantify its usefulness (near the default threshold).

Bayes is scored with a similar consideration, built around probability.

Reply via email to