Re: mailspike dot net Minus 1?
Matus UHLAR - fantomas <[email protected]>
| Newsgroups | gmane.mail.spam.spamassassin.general |
|---|---|
| Message-ID | <[email protected]> |
>On 2025-01-15 at 04:21:41 UTC-0500 (Wed, 15 Jan 2025 10:21:41 +0100) >Matus UHLAR - fantomas <[email protected]> >is rumored to have said: >>It seems that RCVD_IN_MSPIKE_H2 is the only one that produces >>significant score: >> >>50_scores.cf: score RCVD_IN_MSPIKE_ZBI 2.7 >>50_scores.cf: score RCVD_IN_MSPIKE_L5 2.5 >>50_scores.cf: score RCVD_IN_MSPIKE_L4 1.7 >>50_scores.cf: score RCVD_IN_MSPIKE_L3 0.9 >>50_scores.cf: score RCVD_IN_MSPIKE_H3 -0.01 >>50_scores.cf: score RCVD_IN_MSPIKE_H4 -0.01 >>50_scores.cf: score RCVD_IN_MSPIKE_H5 -1.0 >>50_scores.cf: score RCVD_IN_MSPIKE_BL 0.01 >>50_scores.cf: score RCVD_IN_MSPIKE_WL -0.01 >>72_scores.cf:score RCVD_IN_MSPIKE_BL 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_H2 0.001 -1.794 0.001 -1.794 >>72_scores.cf:score RCVD_IN_MSPIKE_H3 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_H4 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_H5 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_L2 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_L3 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_L4 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_L5 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_WL 0.001 0.001 0.001 0.001 >>72_scores.cf:score RCVD_IN_MSPIKE_ZBI 0.001 0.001 0.001 0.001 On 15.01.25 09:23, Bill Cole wrote: >It is worth noting that the 72_scores.cf file is what the RuleQA >process produces. I haven't dug into the details, but it looks like >Mailspike is ONLY really useful at the H2 level. that's possible, but according to https://mailspike.io/ip_verify/usage H2 is supposed to be indication of "Possible legit sender" 50_scores.cf should be generated by mass-checking, where H2 generated no score (why?) and yet, H2 has more significant score that what mass-check generated L5 (excellent reputation) which should be stronger indicator of hamminess. >>Does it make sense to use this WL with this score? > >That has to be a local question. This is what I'm curious about. Of course I can locally increase the score locally. >For the people going to the trouble of submitting human-classified ham >and spam results to RuleQA, RCVD_IN_MSPIKE_H2 was a fairly strong >indicator of non-spam. So it makes sense IF your mailstream looks a >lot like that of the submitters. Sadly, mailstreams vary a great >deal, so no individual site is likely to match the non-random sample >that we have access to. should I assume that RuleQA works with different corpus than masscheck? >I don't think the listing of behemoth sources as "good-ish" is wrong >per se, because many sites can show that they get more ham from GMail >than spam. MS is a somewhat different story, because they try to >segregate their suspect mail to a subset of output points. If your >mail does not include much GMail ham, it may make sense to set the >scores locally. E.g. I have: > >/etc/mail/spamassassin/local.cf:score RCVD_IN_MSPIKE_H2 0.2 >/etc/mail/spamassassin/local.cf:score RCVD_IN_MSPIKE_H3 0.1 > >Those are based on careful analysis a few years ago, so I can't even >be sure that they make sense for me today, but they certainly are not >causing visible trouble, -- Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Christian Science Programming: "Let God Debug It!".