Rob McEwen wrote: > For example, in my own spam filtering, I recently started seeing > far too many FPs where legit hand-typed messages were hit on by two > of the DNSBLs I mentioned above (not talking about hostkarma, btw). > I had each of them scoring "below threshold"--but both together had > a score that was just above threshold and this was causing legit > mail to go into spam folders. That inspired me to back off of those > two DNSBLs by one point each. But, even with their lowered score, I > still find each of those two lists very helpful for putting many > spams just over the top in their scoring, thus reducing spam to my > users, but without causing FPs.
I've got a custom check for that exact purpose (and a similar one for the URIBLs). You can find it in my khop-bl channel (which adds PSBL, JMF, BRBL, VIRBL, and an anti-APNIC rule in addition to other adjusters). You can view it at the site in my sig below, and I've also included it here: # DNSBLs should not single-handedly promote ham to rejected spam meta KHOP_DNSBL_ADJ ( 2*RCVD_IN_BL_SPAMCOP_NET + 1.6*RCVD_IN_NJABL_PROXY + 2.7*RCVD_IN_NJABL_RELAY + 2.1*RCVD_IN_NJABL_SPAM + 0.9*RCVD_IN_PBL + 1.6*RCVD_IN_SBL + 3*RCVD_IN_XBL + 0.8*RCVD_IN_SORBS_SOCKS + 1.8*RCVD_IN_PSBL + 1.7*RCVD_IN_JMF_BL + 1.8*RCVD_IN_JMF_BR + 2*RCVD_IN_BRBL_RELAY + 1*RCVD_IN_BRBL_LASTEXT ) > 8 describe KHOP_DNSBL_ADJ Undo autokill from DNSBL overlap tflags KHOP_DNSBL_ADJ nice score KHOP_DNSBL_ADJ -2.6 Another adjuster in that channel will bump scores UP if there isn't already too much incestuousness (rather than my specifically bumping trusted RBLs and then again having to deal with the overlap issue). My khop-blessed channel has adjusters for the DNS whitelists going the other way, as mentioned in other threads. -- Adam Katz khopesh on irc://irc.freenode.net/#spamassassin http://khopesh.com/Anti-spam
