The Mail::SpamAssassin::Conf man page includes a section on tflags and
their various functions, but generally speaking tflags allow you to
alter the way in which a rule is processed.
The most common ones that I make use of are "multiple" and "maxhits"
in order to allow a rule to be scored for each time it hits, but to
stop counting after some threshold. I also use the "net" tflag so
that RBL checks only run when a net-based ruleset is loaded.
As an example, I have various uri rules to detect emails from
questionable journals. Since it's possible that someone might be
having a legitimate mail conversation about that journal and share the
URL to their site, I want to count how many times the URL appears, so
I add a "multiple" tflag for the rule. More appearances means the
mail is more likely to be advertising the journal or soliciting
articles. On the other hand, once it's been seen eight time (or 15 or
whatever), there's a diminishing return on that rule's ability to tell
me anything more about the email, so I use "maxhits=8" to keep it from
continuing to look for the uri (and to stop scoring additional points).
On Thu, 3 Aug 2017, John Schmerold wrote:
I don't understand the purpose of tflags. Where is this parameter explained?
--
Public key #7BBC68D9 at | Shane Williams
http://pgp.mit.edu/ | System Admin - UT CompSci
=----------------------------------+-------------------------------
All syllogisms contain three lines | sha...@shanew.net
Therefore this is not a syllogism | www.ischool.utexas.edu/~shanew
