On Fri, Jul 3, 2009 at 22:43, RW<rwmailli...@googlemail.com> wrote: > > I think it might be worth having 2 XBL tests, a high scoring test on > last-external and a lower-scoring test that goes back through the > untrusted headers. > > I understand that Spamhaus doesn't recommend this, because dynamic IP > addresses can be reassigned from a spambot to another user, but I added > my own rule it does seem to work. In my mail it hits about 9% of my > spam, with zero false-positives. I suspect that part of this is down to > UK dynamic addresses being very sticky, but I ran my mailing lists > through SA for a few weeks and got 3 FPs out of ~2400. > > I think it's probably worth a point or so, and essentially it's free > - all of the zen lookups get done for SBL.
we used to do it this way, but the FPs are (surprisingly) high due to dynamic-address-pool churn. compare: OVERALL% SPAM% HAM% S/O RANK SCORE NAME 5.100 10.1740 0.0200 0.998 0.65 0.01 T_RCVD_IN_XBL (with trusted-networks) 5.417 10.6074 0.2203 0.980 0.18 0.00 RCVD_IN_XBL (with all nets) I'll forward on the old mail for hysterical raisins. --j.
