Ben Rometsch wrote: > Hi, > > I've got version 1.3.9.1 running nicely on my server and have set it > up to work purely off message scoring. I want to tune the limits for > flagging/rejecting mail based on the overall score, but cant figure > out a way to get any relevant stats. > > What I'd like to do is be able to search through the mail in /spam > and /notspam and see what the message scores are for each email; that > way I can process the folders and see what the spread of message > scores is, and look at the ham with high scores and spam with low > scores to figure out if I can tweak ASSP to be even more effective. > > It seems that the mail stored in /spam and /notspam do not include any > of the header tags that ASSP puts into the message that make it to my > inbox. Is there a way of turning this on, or is there a better method > available to me? > > Thanks. > The other item to consider is some checks may be "better" suited to outright blocking than message scoring. In my own case, I have the following set to outright block instead of scoring.
useHeloBlacklist, DoFakedLocalHelo, DoValidFormatHelo, DoInvalidFormatHelo, DoBlackDomain, DoCountryBlocking, DoNoValidLocalSender, DoDenySMTP, DoDenySMTPstrict, DoFrequencyIP, DoDomainIP, DoPenalty, DoPenaltyMessage, DoPenaltyExtreme, ValidateRBL, DoBlockExes, DoBombSenderRe, DoBombHeaderRe, DoBombRe, DoBlackRe, DoScriptRe Blocking as soon as possible reduces the load on your server. Especially for the IP-based blocks, these can be phenomenal tools. I emphasize this because you said your server is "pure" scoring. And invalid local recipients or faked locals should be blocked immediately as well (unless you're running a server that you need to accept a LOT more than I'm willing to tolerate!). At the moment, based on a 14-hour period (since I upgrade to the latest 1.4.1), my strongest message rejection appears to be HELO Invalid (431 messages). And 361 local recipients rejected. My current connection statistics for rejected IP's are almost 0 - interesting. My overall block rate is about 80% - which means that after all the mailing lists I'm subscribed to are allowed in, I'm blocking a LOT of junk! I'm just supporting a small company domain of < 20 users - I shudder to think what the other guys here with 1,000+ user bases have to put up with! -- Daniel ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
