On Tue, 28 Nov 2017 09:07:34 -0800 (PST) John Hardin wrote: > On Tue, 28 Nov 2017, RW wrote: > > > On Mon, 27 Nov 2017 17:37:35 -0800 (PST) > > John Hardin wrote: > > > >> The ".date" TLD just started bombarding my inbox... > > > >> score FROM_RARE_TLD 3.000 > >> score REPTO_RARE_TLD 3.000 > >> score URI_RARE_TLD 3.000 > > > > It's pretty common for the author domain to be in the body of an > > email and/or a reply-to header. With "parse_dkim_uris 1", > > URI_RARE_TLD can also come from an author DKIM signature. > > > > I don't think it's sensible to score them this way, it's a lottery > > between conservative and full poison pill. > > True, the scoring should be site-specific. Poison pill works *for > me*, because my volume is low and I quarantine everything SA rejects > for review (and inclusion in my masscheck corpora).
But it's not poison pill, the score can be 3, 6 or 9. Some spams will only have one of those hits. A lot of ham using those TLDs will hit two or three. > In the future I'll omit the score lines when I post updated REs. > Everybody: take the scores for these rules (same as the scores for > *any* rules posted to the list) with a grain of salt. What I'm saying doesn't have anything to do with the rule scores (as long as the individual scores are below poison pill level). The point is that the distinction between the three score levels is based more on noise than real information. The way you are doing it relies on very little ham using these TLDs, and constant vigilance to make sure that doesn't change. For the same current TP rate, meta rules should degrade more gracefully.
