Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (athena.apache.org: domain of rwmaillists@googlemail.com
 designates 209.85.215.178 as permitted sender)
Date: Mon, 21 Nov 2011 13:50:05 +0000
From: RW <rwmaillists@googlemail.com>
To: users@spamassassin.apache.org
Subject: Re: Return Path Whitelists, RP_SAFE, RP_CERTIFIED, =?UTF-8?Q?RP?=
 =?UTF-8?Q?=5FMATCHES=E2=80=8F?=
Message-ID: <20111121135005.381d8410@gumby.homeunix.com>
In-Reply-To: <32870476.post@talk.nabble.com>
References: <32870476.post@talk.nabble.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Mon, 21 Nov 2011 03:11:48 -0800 (PST)
pipjg wrote:

> 
> Hi,
> 
> Was wondering if could have some advice, and I probably know what I'm
> going to do anyway, just wanted a few others opinions..
> 
> I've been analysing a load of mail which is having it's SA score
> reduced by what looks like paid for whitelists. A view of the SA
> scores I'm seeing is:
> 
> Rule  	Total  	Ham  	%  	Spam  	%
> RP_MATCHES_RCVD  	161,165 	142,559 	88.5
> 18,606 	11.5 RCVD_IN_RP_SAFE  	22,405 	22,399
> 	100 	6 	0 RCVD_IN_RP_CERTIFIED  	22,130
> 	22,125 	100 	5 	0 RCVD_IN_RP_RNBL
> 	12,794 	43 	0.3 	12,751 	99.7
> T_RP_MATCHES_RCVD  	7,080 	5,072 	71.6
> 2,008 	28.4
> 
> Now looking at virtualls ALL of these they look like SPAM.

No they don't, you haven't read your own results correctly.
RCVD_IN_RP_SAFE and RCVD_IN_RP_CERTIFIED are ~100% Ham. RCVD_IN_RP_RNBL
is a blacklist rule, so it's supposed to hit spam.

[T_]RP_MATCHES_RCVD are not ReturnPath whitelist rules:

describe RP_MATCHES_RCVD  Envelope sender domain matches handover relay
domain

Everything related to ReturnPath.net/senderscore is working
remarkably well for you.


> For some reason I can't find any scores for T_RP_MATCHES_RCVD. Am I
> being dumn here? Does the T_ mean something I don't know?

T_* rules are under test, so it's an earlier name for RP_MATCHES_RCVD.