* Gerald Oskoboiny <
[email protected]> [2004-06-01 13:01-0400]
> For the last few months any email to impressive.net with a SA
> score > 10 has been rejected, and any email I receive with score
> 5-10 goes into a mailbox called 'probable-spam' which in theory I
> could review periodically for false positives, but in practice
> just gets ignored. (it has 38643 messages since Jan 14, 292/day)
>
> I hate silently ignoring email, so I wonder if I should decrease
> the rejection threshold to 5 or something.
I have been really happy with my spam blocking setup, and still have
not received a single complaint about valid mail being blocked.
Since June 3, 4899 messages were filtered to my probable-spam
mailbox but not rejected (messages that scored 5-10); I scanned
about 2k of those manually and found two false positives, an
inquiry about using a photo, and someone asking about a hotel
in Italy; both were tagged BAYES_99 which contributed 5.4 to the
score (but both scored < 6 total.)
So I just lowered my threshold for rejection to 6, and I am doing
away with this probable-spam mailbox, so I don't have to worry
about mail being silently ignored any more.
Oh... 6090 messages have entered my spam honeypot in that time,
fed directly into sa-learn --spam. (messages that scored > 10 were
rejected as usual, and not fed into sa-learn... I wonder if I
should try to exclude my honeypots from smtp-time spam blocking?)
Distribution of SA scores in probable-spam since June 3:
gerald@ogobogo:/home/gerald; cat mail/probable-spam | formail -s formail -c -XX-Spam-Status | cut -d= -f2 | cut -d. -f1 | sort -n | uniq -c
269 5
377 6
695 7
494 8
379 9
523 10
503 11
358 12
415 13
292 14
223 15
177 16
94 17
50 18
27 19
18 20
3 21
1 23
1 24
(hmm, why so many > 10?? Those should have been rejected.
Maybe some network tests are not being done at smtp time?)
--
Gerald Oskoboiny <
[email protected]>
http://impressive.net/people/gerald/