Re: boosting PBL score suggestions

2009-07-22 Thread Benny Pedersen

On Wed, July 22, 2009 17:04, Justin Mason wrote:
> when that was set a couple of years back, PBL had a few FPs -- the FP
> rate has dropped greatly since then, going by recent ruleqa results.
> go ahead and bump it up.

http://www.spamhaus.org/faq/answers.lasso?section=DNSBL%20Usage#202
What do the 127.0.0.* Return Codes mean?

can qa use seperate return codes to see how it compose to corpus ?, if there is 
a big diff there it makes sense to do seperate rbl
testing in sa for each return code

-- 
xpoint



Re: boosting PBL score suggestions

2009-07-22 Thread Charles Gregory

On Wed, 22 Jul 2009, Aaron Bennett wrote:
We're noticing that much of the spam which makes it through our filter 
hits the spamhaus pbl rule.  However, that rule by itself scores only 
0.9.


As per other recent threads, the PBL has become so reliable that it
is now considered 'safe' to use as an RBL blacklist check at the MTA
level before coming into spamassassin. Just use 'zen.spamhaus.com' for 
your check instead of sbl or xbl. If you don't have RBL checking before 
you invoke spamassassin (but you really should) then you can just score 
the PBL rule 10 or more


- Charles


Re: boosting PBL score suggestions

2009-07-22 Thread MySQL Student
> when that was set a couple of years back, PBL had a few FPs -- the FP
> rate has dropped greatly since then, going by recent ruleqa results.
> go ahead and bump it up.

I just checked many of my FPs that have RCVD_IN_PBL, and increasing
the score there would sure help me too! Thanks for spotting that,
Aaron.

Best,
Alex


Re: boosting PBL score suggestions

2009-07-22 Thread Justin Mason
On Wed, Jul 22, 2009 at 14:41, Aaron Bennett wrote:
> Hi,
>
> We're noticing that much of the spam which makes it through our filter hits
> the spamhaus pbl rule.  However, that rule by itself scores only 0.9.  Since
> we quarantine spam through a web interface (maia), we're pretty tolerant of
> false positives.
>
> Do any of you folks have a suggestion about raising the RCVD_IN_PBL score?
>  I was thinking of raising it as high as 2 or 3.  Another thing I'm
> considering is a META rule that scores for PBL + BAYES_60, etc.
>
> I am generally reluctant to mess much with the default scoring -- but I'm
> always looking for a better setup.

when that was set a couple of years back, PBL had a few FPs -- the FP
rate has dropped greatly since then, going by recent ruleqa results.
go ahead and bump it up.

-- 
--j.


boosting PBL score suggestions

2009-07-22 Thread Aaron Bennett

Hi,

We're noticing that much of the spam which makes it through our filter 
hits the spamhaus pbl rule.  However, that rule by itself scores only 
0.9.  Since we quarantine spam through a web interface (maia), we're 
pretty tolerant of false positives.


Do any of you folks have a suggestion about raising the RCVD_IN_PBL 
score?  I was thinking of raising it as high as 2 or 3.  Another thing 
I'm considering is a META rule that scores for PBL + BAYES_60, etc.


I am generally reluctant to mess much with the default scoring -- but 
I'm always looking for a better setup.


Aaron Bennett
Clark University ITS