boosting PBL score suggestions

[Aaron Bennett <ab...@clarku.edu>]

Hi,

We're noticing that much of the spam which makes it through our filter 
hits the spamhaus pbl rule.  However, that rule by itself scores only 
0.9.  Since we quarantine spam through a web interface (maia), we're 
pretty tolerant of false positives.

Do any of you folks have a suggestion about raising the RCVD_IN_PBL 
score?  I was thinking of raising it as high as 2 or 3.  Another thing 
I'm considering is a META rule that scores for PBL + BAYES_60, etc.

I am generally reluctant to mess much with the default scoring -- but 
I'm always looking for a better setup.

Aaron Bennett
Clark University ITS

Re: boosting PBL score suggestions

[Benny Pedersen <me...@junc.org>]

On Wed, July 22, 2009 17:04, Justin Mason wrote:
> when that was set a couple of years back, PBL had a few FPs -- the FP
> rate has dropped greatly since then, going by recent ruleqa results.
> go ahead and bump it up.

http://www.spamhaus.org/faq/answers.lasso?section=DNSBL%20Usage#202
What do the 127.0.0.* Return Codes mean?

can qa use seperate return codes to see how it compose to corpus ?, if there is a big diff there it makes sense to do seperate rbl
testing in sa for each return code

-- 
xpoint

Re: boosting PBL score suggestions

[MySQL Student <my...@gmail.com>]

> when that was set a couple of years back, PBL had a few FPs -- the FP
> rate has dropped greatly since then, going by recent ruleqa results.
> go ahead and bump it up.

I just checked many of my FPs that have RCVD_IN_PBL, and increasing
the score there would sure help me too! Thanks for spotting that,
Aaron.

Best,
Alex

Re: boosting PBL score suggestions

[Justin Mason <jm...@jmason.org>]

On Wed, Jul 22, 2009 at 14:41, Aaron Bennett<ab...@clarku.edu> wrote:
> Hi,
>
> We're noticing that much of the spam which makes it through our filter hits
> the spamhaus pbl rule.  However, that rule by itself scores only 0.9.  Since
> we quarantine spam through a web interface (maia), we're pretty tolerant of
> false positives.
>
> Do any of you folks have a suggestion about raising the RCVD_IN_PBL score?
>  I was thinking of raising it as high as 2 or 3.  Another thing I'm
> considering is a META rule that scores for PBL + BAYES_60, etc.
>
> I am generally reluctant to mess much with the default scoring -- but I'm
> always looking for a better setup.

when that was set a couple of years back, PBL had a few FPs -- the FP
rate has dropped greatly since then, going by recent ruleqa results.
go ahead and bump it up.

-- 
--j.

Re: boosting PBL score suggestions

[Charles Gregory <cg...@hwcn.org>]

On Wed, 22 Jul 2009, Aaron Bennett wrote:
> We're noticing that much of the spam which makes it through our filter 
> hits the spamhaus pbl rule.  However, that rule by itself scores only 
> 0.9.

As per other recent threads, the PBL has become so reliable that it
is now considered 'safe' to use as an RBL blacklist check at the MTA
level before coming into spamassassin. Just use 'zen.spamhaus.com' for 
your check instead of sbl or xbl. If you don't have RBL checking before 
you invoke spamassassin (but you really should) then you can just score 
the PBL rule 10 or more....

- Charles