So Darrell, what do you have the "number of comments that are required" set
for?
I actually stopped using comments because of too many false positives.
----- Original Message -----
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Wednesday, August 24, 2005 11:57 AM
Subject: Re: [Declude.JunkMail] CMDSPACE
Kevin,
The comments test is defined as
COMMENTS comments a x b 0
where a = the number of comments that are required to add "b" amount of
weight to the message.
Darrell
---------------------------------------------------------
invURIBL - Intelligent URI filtering. Stops 85% of SPAM with the default
configuration. Try it today - http://www.invariantsystems.com
Kevin Rogers writes:
Thanks. How do I increase the COMMENT threshhold? Darrell
([EMAIL PROTECTED]) wrote:
My users get a lot of legit emails that get flagged with both these and
then end up with a weight of 12 and get put in their bulk folder. I
mean a lot. Just regular emails sent from Aetna.com, Principal.com,
other big insurance carriers. Should I reduce the weight of them? Are
they working like they should? Anyone else see this a lot?
If you find on your system that the ratio of legit/non-legit messages
for a particular test is more in favor of legit you should absolutly
lower the weight of those tests. For my system the CMDSPACE is a very
effective test since I can do WHITELIST AUTH / WHITELIST my ip blocks of
clients. Outlook is a nasty example of a client that will fail the
CMDSPACE test. In regards to comments I have not run across any issues
with many false positives with that test. However, I did tweak the # of
comments to a higher value than the default so that may help.
Darrell
------------------------------------------------
DLAnalyzer - Comprehensive reporting utility for Declude Junkmail and
Virus. Download it today - http://www.invariantsystems.com
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.] ---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
------------------------------------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration,
MRTG Integration, and Log Parsers.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
