That was referenced in my last post. I'm trying to figure out the best counterweight method. That should only happen with an inline attached file (images can be sent both ways). Someone gave me a good recommendation for a fix and I'm researching it. There's other FP's that while rare, could likely also be stopped.
Still though, it's about 98% accurate on files it adds a score to even with obvious flaws, and I can only find one E-mail that failed improperly because of the added weight out of 1193 caught by the filter in the last 24 hours (that E-mail failed multiple other tests as well of course). It's hard to tell though how many E-mails were scored out of the total, meaning that they either didn't have attachments tagged in the boundaries, but I'm guessing more than 2/3 didn't. BTW, I'm not counting messages on the topic for obvious reasons.
All in all, the messages most likely to fail even accidentally are still spam (having links with random characters, which isn't desired for this test but can't be avoided). The rate at which this is accurate is far better than other tests like HELOBOGUS for example, but on the other hand, spammers almost always fake the HELO while they don't always include gibberish.
I'm probably going to reduce my weight just to be safe, especially from FP's in both the subject and the body from the same string of characters. I'm thinking that 3/10 is more appropriate for each.
Add the test as a 0 score and add another 0 test for just the attachment line so you can see what would get scored. If they both appear in the headers, it wouldn't get scored, the remainders should either be mostly spam, or very low scoring in the first place. Note that Yahoo has boundaries and ads that will trigger this test and that should be counterweighted with the line:
REVDNS -5 ENDSWITH .yahoo.com
I've gotten a lot of good feedback in PM's and when I get it to work more accurately, I'll post the configuration. Nevertheless, it's pretty workable as is, though it depends on the entirety of your config.
Matt
Frederick Samarelli wrote:
Matt,
How well does this work.
BODY -5 CONTAINS attachment
I noticed it did not counter weight a photo attachment.
Fred
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
