Re: Fwd: Fwd: Re: effectiveness of DCC checks?

2015-04-16 Thread Axb 

On 04/16/2015 02:15 PM, Mark Martinec wrote:


I don't agree with moving a DCC rule into a __* rule or setting
its score to a near zero. I find DCC hits useful as they are now:
contributing to the overall score, bit not so large as to make
a major effect by themselves.


FWIW; I totally agree with Mark.

Re: Fwd: Fwd: Re: effectiveness of DCC checks?

2015-04-16 Thread Mark Martinec 

Kevin A. McGrail wrote:

Vernon, do you have a  recommended score for the implementation of
DCC with SA? There are concerns that bulk mail from good senders has
been hit by DCC which is completely by design.


Vernon replied off-list so I wanted to bring the relevant portion back
to the list:

"My general suggestion is that SA+DCC clients that don't use whitelists
for bulk mail (I still say whitelists are required) should use a DCC
score that is not large enough to tell SA to mark a message "spam"
purely from the DCC result, but large enough to push other signs of 
spam

over the threshold. vjs"


With which the current 1.1 score points complies just fine.

The whitelisting for bulk mailers in the DCC config file is 
advised/required

by the DCC docs anyway.


So I think DCC users should consider moving DCC to an __ test and
identify things like DNSBLs with whitelist entries and other tests that
can use DCC to meta more effective classification rules.
Anyone has any thoughts on rules to submit, let me know!


I don't agree with moving a DCC rule into a __* rule or setting
its score to a near zero. I find DCC hits useful as they are now:
contributing to the overall score, bit not so large as to make
a major effect by themselves.

  Mark

Fwd: Fwd: Re: effectiveness of DCC checks?

2015-04-16 Thread Kevin A. McGrail 

Vernon, do you have a  recommended score for the implementation of

> DCC with SA? There are concerns that bulk mail from good senders has
> been hit by DCC which is completely by design.

Vernon replied off-list so I wanted to bring the relevant portion back
to the list:

"My general suggestion is that SA+DCC clients that don't use whitelists
for bulk mail (I still say whitelists are required) should use a DCC
score that is not large enough to tell SA to mark a message "spam"
purely from the DCC result, but large enough to push other signs of spam
over the threshold. vjs"

So I think DCC users should consider moving DCC to an __ test and
identify things like DNSBLs with whitelist entries and other tests that
can use DCC to meta more effective classification rules.

Anyone has any thoughts on rules to submit, let me know!

Regards,
KAM