required_score aggressive ??

[R Lists06 <li...@abbacomm.net>]

When looking up required_score info, as most know, it say that the default
is 5.0 and that it is considered aggressive in various circumstances

Used to be called required_hits

When I first started using SA I was told that as an ISP going in the 4.0
range give or take a little was an excellent choice.

If you are able to chime in, please share your wisdom in any area about
required_score and/or just how aggressive is everyone on the list as I am
thinking of tweaking a little lower.

Thanks in advance

 - rh

--
Robert - Abba Communications
   Computer & Internet Services
 (509) 624-7159 - www.abbacomm.net

RE: required_score aggressive ??

[Sietse van Zanen <si...@wizdom.nu>]

I use sendmail and spamassassin-milter. I configured SA to tag messages
as spam if they score 6.0 points. The milter rejects if the score gets
above 15. I use every plugin available, dcc, fuzzy, razor, pyzor, DNSBL
etc, so usually spam scores above 15, and I have never seen a false
positive with a score higher than that. This counts for about 80-85% of
all spam I receive, and spam being 90-95% of total mail volume.

Messages that score between 6.0 and 15.0 are delivered to the user (on
exchange), with altered subject and original message as attachment
(report_safe). I would say, that bayes is the most valuable tool when it
comes to messages that have a lower spam score. Almost all messages that
score 6-9 points are scored 3.5 by bayes (99-100% certainty) and hence
would not be tagged as spam if I would not use bayes. This is about
10-15% of all spam I receive. The remaining 5-10% scores 10-15. I have
seen only a few false positives in the 6-15 range, never scored by
bayes. In my set up bayes has a near 100% accuracy.

ISPs usually reject all mail above a certain score, regularly set to
4-5. This will result in more FPs, considering their usually high mail
volume. In the end it's all a choice between relaying more spam to
subscribers or putting more work into manually whitelisting etc. But in
any case the configuration should include bayes, DNS blacklisting and
the usual regexp rules. For higher accuracy, but also higher server
loads, other plugins can be used too.

-Sietse


-----Original Message-----
From: R Lists06 [mailto:lists06@abbacomm.net] 
Sent: Wednesday, December 06, 2006 4:45 PM
To: users@spamassassin.apache.org
Subject: required_score aggressive ??


When looking up required_score info, as most know, it say that the
default
is 5.0 and that it is considered aggressive in various circumstances

Used to be called required_hits

When I first started using SA I was told that as an ISP going in the 4.0
range give or take a little was an excellent choice.

If you are able to chime in, please share your wisdom in any area about
required_score and/or just how aggressive is everyone on the list as I
am
thinking of tweaking a little lower.

Thanks in advance

 - rh

--
Robert - Abba Communications
   Computer & Internet Services
 (509) 624-7159 - www.abbacomm.net

Re: required_score aggressive ??

[Kris Deugau <kd...@vianet.ca>]

R Lists06 wrote:
> When looking up required_score info, as most know, it say that the default
> is 5.0 and that it is considered aggressive in various circumstances
> 
> Used to be called required_hits
> 
> When I first started using SA I was told that as an ISP going in the 4.0
> range give or take a little was an excellent choice.
> 
> If you are able to chime in, please share your wisdom in any area about
> required_score and/or just how aggressive is everyone on the list as I am
> thinking of tweaking a little lower.

I'd stick with the default until you see how SA performs.

I've been using the default threshold of 5 on two ISP mail systems for 
~4+ years, and my own personal server for longer, with very little 
trouble.  The occasional (rare) FPs have seen scores anywhere from just 
over 5 up to ~15 or so IIRC.

IMO it's better to tweak rule scores than to use the VERY blunt 
instrument of changing the spam threshold score.

-kgd

Re: required_score aggressive ??

[Rob Mangiafico <rm...@lexiconn.com>]

On Wed, 6 Dec 2006, Ray Anderson wrote:
>   I use a required_score of 3 and so far have had zero positives (more 
> than 3 years running).
> 
> I have customers that also run 3 and have opted to have the server 
> /discard/ the message (not quarantine, but /DISCARD/) if it is 
> identified as spam.  So far none of those users have complained about 
> not receiving e-mail.
> 
> -=Ray
> 
> R Lists06 wrote:
> > When looking up required_score info, as most know, it say that the default
> > is 5.0 and that it is considered aggressive in various circumstances
> >
> > Used to be called required_hits
> >
> > When I first started using SA I was told that as an ISP going in the 4.0
> > range give or take a little was an excellent choice.
> >
> > If you are able to chime in, please share your wisdom in any area about
> > required_score and/or just how aggressive is everyone on the list as I am
> > thinking of tweaking a little lower.

We handle mail for a few thousand domains and probably process a few 
million emails per day. What we've found is 5-7 is quite aggressive, and 
does catch a few legit emails for a small group of users. 7-9 is moderate 
and catches a large majority of spam, and minimizes false positives to 
only a few each day. "9" is what we consider a safe number to get false 
hits down to zero or as close as possible while still catching a good deal 
of spam. This is of course with RBLs, SARE, Fuzzy, Botnet, etc...

Rob

Re: required_score aggressive ??

[Ray Anderson <rs...@rb-com.com>]

  I use a required_score of 3 and so far have had zero positives (more 
than 3 years running).

I have customers that also run 3 and have opted to have the server 
/discard/ the message (not quarantine, but /DISCARD/) if it is 
identified as spam.  So far none of those users have complained about 
not receiving e-mail.

-=Ray


R Lists06 wrote:
> When looking up required_score info, as most know, it say that the default
> is 5.0 and that it is considered aggressive in various circumstances
>
> Used to be called required_hits
>
> When I first started using SA I was told that as an ISP going in the 4.0
> range give or take a little was an excellent choice.
>
> If you are able to chime in, please share your wisdom in any area about
> required_score and/or just how aggressive is everyone on the list as I am
> thinking of tweaking a little lower.
>
> Thanks in advance
>
>  - rh
>
> --
> Robert - Abba Communications
>    Computer & Internet Services
>  (509) 624-7159 - www.abbacomm.net
>
>
>
>
>