> One of my users received a message today that landed in the spambucket.
Upon
> further review, it's a legit message from Paypal. In fact, SA even
> recognized that it appeared to be a legit Paypal message, but since the
> adjustment was a whopping -0.0 points, it wasn't enough to bring it back
> below 5.0. Why doesn't this rule carry any negative weight, and what else
We tend to not release negative-scored rules by default, since they are
potentially expolitable. You could probably assign -.5 or -1 to that rule
safely.
> could I be doing that would avoid this sort of FP?
You don't seem to be running net tests. I see headers for both SPF and
DomainKeys in that mail. These tests should have pulled the score down by
some amount if you had run them.
> (In other news, I have NO idea why the SARE_SXLIFE rule was triggered. I
> mean, I enjoy shopping on Ebay as much as the next geek, but it's not THAT
> exciting!)
I'd have to look at the rule and guess, but as it is a body test and you
didn't supply the message body, it would only be a guess. May actually be
an FP.
Loren
