Assuming the big guys spool OUT from their INBOUND MX records I think that would hold true....
But for example here at my office, we have (2) MX records, which are our inbound filter gateways. However outbound mail spools through DIFFERENT gateways, so all mail leaving my organization should actually fail that test... Most likely the big guys also separate "inbound" and "outbound" mail to different IP/servers.. (but I could be wrong) -Tom -----Original Message----- From: Cris Porter [mailto:[EMAIL PROTECTED]] Sent: Monday, December 09, 2002 9:49 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Populardomains test What if you set the positive weight of the popular domains equal to the negative weight of the IPNOTINMX test? Won't only invalid mail from these domains add to the accumulated weight? Cris Porter JVC America -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Monday, December 09, 2002 9:19 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Populardomains test >I'm missing something that could trigger false positives? What if I send you a note from my yahoo.com account that just happens to trigger one of your filters because I am telling you about a new spam technique? With the way you have it set, just me sending a mail to you from my yahoo.com account is now at 55% (or is that 70% if abuse is 15% and postmaster is 15%) of your hold weight. While I am also testing for those domains, I have that combination (total if it fails domain, abuse and postmaster) at 50% of subject modification and 40% of hold. Just my .02. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
