Re: false positives from AOL

[Marcel van der Goot <vd...@earthlink.net>]

I wrote:
> The first rule says that there was no rDNS record; that's bad, so
> a lot of points are assigned. Then the second rule says that the
> (non-existent) rDNS record did not match AOL; well, duh!

To which "jdow" <jd...@earthlink.net> responded:

> I wonder if this might work:
  meta AOL_MESSED_UP        ( NO_RDNS_DOTCOM_HELO && FAKE_HELO_AOL )
  describe AOL_MESSED_UP    Let's not compound the felony here
  score AOL_MESSED_UP       -2

Indeed, this fixes the problem (after correction of IP to UP) in a much
better way than reducing the individual scores. Thank you. Is there a
way to specify that all rules of the FAKE_HELO type should be skipped
if NO_RDNS_DOTCOM_HELO holds, or would I have to add the above for
each?

-Marcel van der Goot


But I guess that kind of
rule would have to be added for each of the FAKE_HELO tests

Re: false positives from AOL

[jdow <jd...@earthlink.net>]

From: "Marcel van der Goot" <vd...@earthlink.net>

> I wrote:
> > The first rule says that there was no rDNS record; that's bad, so
> > a lot of points are assigned. Then the second rule says that the
> > (non-existent) rDNS record did not match AOL; well, duh!
> 
> To which "jdow" <jd...@earthlink.net> responded:
> 
> > I wonder if this might work:
>   meta AOL_MESSED_UP        ( NO_RDNS_DOTCOM_HELO && FAKE_HELO_AOL )
>   describe AOL_MESSED_UP    Let's not compound the felony here
>   score AOL_MESSED_UP       -2
> 
> Indeed, this fixes the problem (after correction of IP to UP) in a much
> better way than reducing the individual scores. Thank you. Is there a
> way to specify that all rules of the FAKE_HELO type should be skipped
> if NO_RDNS_DOTCOM_HELO holds, or would I have to add the above for
> each?

Not that I know of. But then, I am relatively new here.
{^_-}