SA rule question / suggestion

2006-03-16 Thread Barry Callahan
I'm running SpamAssassin 3.1.0 with sendmail, and I think it's great. I'm using milter-spamc to interface with SpamAssassin running as a daemon. It doesn't /quite/ catch everything, and some (very little, actually) SPAM gets through untagged. I spent some time looking at the SPAM and

Re: SA rule question / suggestion

2006-03-16 Thread Matt Kettler
Barry Callahan wrote: I'm running SpamAssassin 3.1.0 with sendmail, and I think it's great. I'm using milter-spamc to interface with SpamAssassin running as a daemon. It doesn't /quite/ catch everything, and some (very little, actually) SPAM gets through untagged. I spent some time

Re: SA rule question / suggestion

2006-03-16 Thread Theo Van Dinter
On Thu, Mar 16, 2006 at 05:15:58PM -0500, Barry Callahan wrote: I spent some time looking at the SPAM and compared it it to the legitimate email I receive. :) So, I was wondering if the following set of logic would be possible to implement in SpamAssassin, either as a collection of rules,

RE: SA rule question / suggestion

2006-03-16 Thread Matthew.van.Eerde
Barry Callahan wrote: On a large percentage of the SPAM that gets through, the only Received: header that exists was put there by my mailserver. The legitimate email, on the other hand ALL has at least one additional Received: header, OR the machine it was received from is allowed to

Re: SA rule question / suggestion

2006-03-16 Thread Daryl C. W. O'Shea
On 3/16/2006 5:49 PM, [EMAIL PROTECTED] wrote: Barry Callahan wrote: On a large percentage of the SPAM that gets through, the only Received: header that exists was put there by my mailserver. The legitimate email, on the other hand ALL has at least one additional Received: header, OR the

Re: SA rule question / suggestion

2006-03-16 Thread Theo Van Dinter
Barry Callahan: On a large percentage of the SPAM that gets through, the only Received: header that exists was put there by my mailserver. BTW, it seems weird to me that you see these results. 58.171 62.4003 34.85560.642 0.820.01 T_RECEIVED_COUNT_01 I did up a quick check to

Re: SA rule question / suggestion

2006-03-16 Thread Barry Callahan
Theo Van Dinter wrote: BTW, it seems weird to me that you see these results. 58.171 62.4003 34.85560.642 0.820.01 T_RECEIVED_COUNT_01 Interesting. I don't seem to have that rule. Which ruleset is it in? I used grep to search for RECEIVED_COUNT in all of my installed

Re: SA rule question / suggestion

2006-03-16 Thread Theo Van Dinter
On Thu, Mar 16, 2006 at 09:28:11PM -0500, Barry Callahan wrote: 58.171 62.4003 34.85560.642 0.820.01 T_RECEIVED_COUNT_01 I did up a quick check to gather some stats from my corpus (last 14 days). Interesting. I don't seem to have that rule. Which ruleset is it in? I used grep to