On Tue, 2018-11-27 at 11:22 -0600, Rick Gutierrez wrote: > El mar., 27 nov. 2018 a las 11:14, Alan Hodgson > (<ahodg...@lists.simkin.ca>) escribió: > > > Wow, that's hard to read. > > > > It was close to being tagged because of the Pakistan relay. Just > > add a few points for Word docs and you should be good. Word docs > > from spammy countries should really get a lot of points. > > Hi Alan , I think it's a valid point, except for one thing, what > happens if you do not attach a document? >
Malware/phishes are usually either in an attachment or the message has a link. Personally I add a lot of points to either if they come through questionable countries. Users can dig them out of their Junk if they happen to be expecting a resume from Algeria. > Something I want to ask you, where can I increase this score or in > what rules? > > You'd probably have to write your own. I'm not even sure where you got that RELAY_PK rule from but I'd guess a download from Ironport or something. Personally I have one set of rules for classifying countries and a few metas on top of those. But you probably wouldn't want to use my rules; my servers are small with homegenous user bases and they don't get real mail from, say, Russia or Pakistan or the Sudan. You can tag a lot of real mail if you're not careful writing rules.
