On 12/01/2017 11:17 AM, Sebastian Arcus wrote:
On 30/11/17 12:45, Matus UHLAR - fantomas wrote:
On 28.11.17 19:39, Sebastian Arcus wrote:
I'm having more and more problems with the HTML_IMAGE_ONLY_* set of
rules recently generating false positives.
Plenty of business emails will include a logo at the bottom - and not
everybody is a graphics expert to make their logo a tiny optimised
gif or png - so some of these are slightly bigger than they should be.
However, this seems to be sufficiently wide spread. Also, many
business emails can be just a few words reply - so the ratio of words
to images triggers the filter in SA. Could the scores on
HTML_IMAGE_ONLY_* set of rules be lowered a bit - or is there
anything else to be done - aside from educating all the internet on
optimising logos in the email signatures? :-)
those have lower scorew with BAYES and network rules enabled.
configure BAYES and enable netowrk rules...
Hi. I have BAYES enabled and DNSBL's enabled (I assume that's what you
mean by network rules?). I still think that a score of 1.6 is quite a
lot, considering that so many emails nowadays contain either an embedded
logo in the signature, with just a few words (in a quick email reply,
for example), or even images inserted, instead of attached to the email.
Please see below an example of a SA report:
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[212.227.126.131 listed in wl.mailspike.net]
0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
1.6 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
2.0 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4808]
0.8 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_MESSAGE BODY: HTML included in message
2.5 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[212.227.126.131 listed in list.dnswl.org]
you've changed SA default scores and now complain about one which hasn't
been touched as cause for FPs?
compare the defaults with yours...
score PYZOR_CHECK 0 1.985 0 1.392 # n=0 n=2
score BAYES_50 0 0 2.0 0.8
hmmmm.... maybe you should rethink those changes.
