On Tue, Sep 29, 2009 at 09:29:16AM +0200, Raymond Dijkxhoorn wrote: > > Ouch, from your point of view it might be fine, but we see strange stuff > with DNSWL allready i certainly would not use this to shortcircuit > things.
What exactly is the strange stuff you see with DNSWL? Granted, I'm not processing millions of messages, only tens of thousands, but I'm not seeing anything fuzzy. I basically shortcircuit on DNSWL_MED and DNSWL_HI, when there aren't any suspicious rules hit (ClamAV/Sanesecurity, relay from africa, bayes over 60 etc). The FP rate is abysmally low.
