It takes alot of experimentation to get the weighting right and as I mentioned 14 was where it worked for me. I slowly tightened the filters and watched what made it through and why, then tested for it. You might reduce false positives by relaxing the weight values on rvdns, postmaster and abuse tests. In a perfect world these would pass but people cant even setup their software correctly in the first place let alone config proper DNS and email accounts.
Holding on spamcop will produce alot of false positives so I warn and weigh 10, then rely on the word filters to push it over the weight thresh hold an email that fails no postmaster, abuse and rvdns wont reach the weight threshhold but if it is spam chances are the word filter will push it over. My success so far is based on ALOT of time spent balancing out all the tests and relying on the weighing system (of course ORDB and OSSCR put a nice dent in things >:-) Add this to your global.cfg so you can see whats hitting: XINHEADER X-Failed: %TESTSFAILED% IPBLACKLIST ipfile D:\IMail\Declude\ipblacklist.txt x 5 0 BLACKLIST fromfile D:\IMail\Declude\blacklist.txt x 5 0 WORDFILTER filter D:\IMail\Declude\wordfilter.txt x 5 0 OSRELAY ip4r relays.osirusoft.com 127.0.0.2 5 0 OSDUL ip4r relays.osirusoft.com 127.0.0.3 5 0 OSSRC ip4r relays.osirusoft.com 127.0.0.4 5 0 OSSMART ip4r relays.osirusoft.com 127.0.0.5 5 0 OSSOFT ip4r relays.osirusoft.com 127.0.0.6 5 0 OSLIST ip4r relays.osirusoft.com 127.0.0.7 5 0 OSFORM ip4r relays.osirusoft.com 127.0.0.8 5 0 ORDB ip4r relays.ordb.org * 5 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 10 0 DSBL ip4r list.dsbl.org * 6 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 4 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 3 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 3 0 BADWHOIS rhsbl whois.rfc-ignorant.org 127.0.0.5 4 0 IPWHOIS ip4r ipwhois.rfc-ignorant.org 127.0.0.6 4 0 MAILFROM envfrom x x 12 0 BADHEADERS badheaders x x 6 0 SPAMHEADERS spamheaders x x 5 0 ROUTING spamrouting x x 5 0 REVDNS revdnsexists x x 3 0 Hope this helps!!! Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - ----- Original Message ----- From: "Glenn \ WCNet" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, June 27, 2002 4:39 PM Subject: Re: [Declude.JunkMail] My Word Filtering File Rick, would you mind providing the details of your tests and weights? I tried HOLDING on weight30 for a couple days, reviewing with SpamReview to see what comes through. It was around 8000 per day. None were legit, so I'm deleting those now. On Weight20 I get between 20,000 and 26,000 per day. Toooo many to screen to determine if blind-deleting is safe, so it's up to the users to do what they want with them. I also have Weight10 and Weight14. I've had a handful of false-positives at 14, and quite a lot at 10. I'm thinking of trying a weight25 and HOLDing those for a couple days to check for false-positive, then maybe auto-deleting on that instead of 30. Glenn Z. ----- Original Message ----- From: Rick Davidson To: [EMAIL PROTECTED] Sent: Thursday, June 27, 2002 2:51 PM Subject: Re: [Declude.JunkMail] My Word Filtering File just wanted to add that we hold at a weight of 14 and have virtually no false positives Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - ----- Original Message ----- From: "Rick Davidson" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, June 27, 2002 3:48 PM Subject: [Declude.JunkMail] My Word Filtering File > here is my word filter file, sorry I had to zip it or it wouldnt have made > it >:-] > > Its amazing how effective the phrase filter is when targeting their SPAM > excuses... > > Have a great day! > Rick Davidson > Buckeye Internet Services > www.buckeyeweb.com > 440-953-1900 > - > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
