You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jm...@apache.org on 2006/11/02 18:02:30 UTC
svn commit: r470417 - /spamassassin/rules/trunk/sandbox/jm/20_dynrdns.cf
Author: jm
Date: Thu Nov 2 09:02:30 2006
New Revision: 470417
URL: http://svn.apache.org/viewvc?view=rev&rev=470417
Log:
tweak RDNS rules
Modified:
spamassassin/rules/trunk/sandbox/jm/20_dynrdns.cf
Modified: spamassassin/rules/trunk/sandbox/jm/20_dynrdns.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/jm/20_dynrdns.cf?view=diff&rev=470417&r1=470416&r2=470417
==============================================================================
--- spamassassin/rules/trunk/sandbox/jm/20_dynrdns.cf (original)
+++ spamassassin/rules/trunk/sandbox/jm/20_dynrdns.cf Thu Nov 2 09:02:30 2006
@@ -168,16 +168,23 @@
# rDNS host-type indicators, as per
# http://tools.ietf.org/wg/dnsop/draft-msullivan-dnsop-generic-naming-schemes-00.txt
-header RDNS_INDICATOR_STA X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.]sta(?:tic)?[\-\.]/i
-header RDNS_INDICATOR_DYN X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.]dyn(?:amic)?[\-\.]/i
-header RDNS_INDICATOR_UNASSIGNED X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.]unassigned[\-\.]/i
-header RDNS_INDICATOR_TYPE X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.](?:dial|modem|isdn|dov|\S?dsl|cable|wireless)[\-\.]/i
-header RDNS_INDICATOR_TYPE2 X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.](?:docsis|dhcp|cpe)[\-\.]/i
-header RDNS_INDICATOR_RES X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.](?:res|resnet|client)[\-\.]/i
+header __RDNS_INDICATOR_DYN X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.]dyn(?:amic)?[\-\.]/i
+
+# surprisingly large ham hitrate
+header __RDNS_INDICATOR_TYPE X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.](?:dial|modem|isdn|dov|\S?dsl|cable|wireless)[\-\.]/i
+
+# this hits a little ham, not too much though
+header __RDNS_INDICATOR_RES X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.](?:res|resnet|client)[\-\.]/i
+
+# these are non-standard, but common in the field; 100% spam correlation!
+# (I think that's a fluke)
+header __RDNS_INDICATOR_TYPE2 X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+[\-\.](?:docsis|dhcp|cpe)[\-\.]/i
###########################################################################
-meta RDNS_DYNAMIC (__RDNS_DYNAMIC_IPADDR || __RDNS_DYNAMIC_DHCP || __RDNS_DYNAMIC_HCC || __RDNS_DYNAMIC_ATTBI || __RDNS_DYNAMIC_ROGERS || __RDNS_DYNAMIC_ADELPHIA || __RDNS_DYNAMIC_DIALIN || __RDNS_DYNAMIC_HEXIP || __RDNS_DYNAMIC_SPLIT_IP || __RDNS_DYNAMIC_YAHOOBB || __RDNS_DYNAMIC_OOL || __RDNS_DYNAMIC_IPADDR2 || __RDNS_DYNAMIC_RR2 || __RDNS_DYNAMIC_COMCAST || __RDNS_DYNAMIC_TELIA || __RDNS_DYNAMIC_VTR || __RDNS_DYNAMIC_CHELLO_NO || __RDNS_DYNAMIC_CHELLO_NL || __RDNS_DYNAMIC_VELOX || __RDNS_DYNAMIC_NTL || __RDNS_DYNAMIC_HOME_NL || __RDNS_DYNAMIC_TDS || __RDNS_DYNAMIC_VIRTUA || __RDNS_DYNAMIC_SPACELAN || RDNS_INDICATOR_DYN)
+# it looks likely these should be used as meta-fodder; both hit quite
+# a lot of ham in some corpora...
+meta RDNS_DYNAMIC (__RDNS_DYNAMIC_IPADDR || __RDNS_DYNAMIC_DHCP || __RDNS_DYNAMIC_HCC || __RDNS_DYNAMIC_ATTBI || __RDNS_DYNAMIC_ROGERS || __RDNS_DYNAMIC_ADELPHIA || __RDNS_DYNAMIC_DIALIN || __RDNS_DYNAMIC_HEXIP || __RDNS_DYNAMIC_SPLIT_IP || __RDNS_DYNAMIC_YAHOOBB || __RDNS_DYNAMIC_OOL || __RDNS_DYNAMIC_IPADDR2 || __RDNS_DYNAMIC_RR2 || __RDNS_DYNAMIC_COMCAST || __RDNS_DYNAMIC_TELIA || __RDNS_DYNAMIC_VTR || __RDNS_DYNAMIC_CHELLO_NO || __RDNS_DYNAMIC_CHELLO_NL || __RDNS_DYNAMIC_VELOX || __RDNS_DYNAMIC_NTL || __RDNS_DYNAMIC_HOME_NL || __RDNS_DYNAMIC_TDS || __RDNS_DYNAMIC_VIRTUA || __RDNS_DYNAMIC_SPACELAN || RDNS_INDICATOR_DYN || __RDNS_INDICATOR_RES || __RDNS_INDICATOR_TYPE2)
header RDNS_NONE X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns= /