spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From RW <rwmailli...@googlemail.com>
Subject Re: Spam email many have RCVD_IN_DNSWL_MED
Date Tue, 11 Oct 2011 17:37:47 GMT
On Tue, 11 Oct 2011 12:28:53 -0400
Michael Scheidell wrote:

> On 10/11/11 12:18 PM, Alessio Cecchi wrote:
> > I'm an italian user of spamassassin. During the last 3 weeks many
> > spam email have rating cut down by the rules "RCVD_IN_DNSWL_MED".
> > Also BAYES_99 can to nothing against this :-(
> college.. new year, new students, new computers, new worms.  as the
> old saying used to go "Its September again (tinc)"
> 
> RCVD_IN_DNSWL_MED means that the ip address owner doesn't spam much,
> and will take immediate action on spams.
> (I have an issue with this being applied to a university, where the 
> it/email admin/staff has no control over the students computers)


DNSWL also encodes information about the type of business or
institution, e.g. I have:

header RCVD_IN_DNSWL_C11 eval:check_rbl_sub('dnswl-firsttrusted',
'127.0.11.\d+')
describe RCVD_IN_DNSWL_C11      Category - Academic

If you want something a little more fine-grained you could replace the
existing rules with meta-rules based on combinations of HI, MED and LOW
with the categorys. A problem with this is that quite a lot of email is
outsourced and shows as "Service/network providers", but the spam that
goes through universities tends to shows as Academic.

Mime
View raw message