[Mimedefang] OT: DNS sanity check

[John Rudd]

Jeff Rife wrote:
>
>> However, I don't reject them on that basis alone.  I mark them as spam 
>> on that basis alone (5 points in SA).  I only reject when the SA score 
>> is 10+
> 
> That's not too bad, then, but I suspect that the number of messages you 
> reject solely because of that extra 5 points is a lot smaller than you 
> think it is, and if you take that into consideration, the false 
> positive rate is quite a bit higher than you suspect.
> 

The false positive rate isn't based solely on rejections, it's based on 
things which triggered the Botnet rule.

At home, I get a small enough message rate (~300/day) that I can easily 
look at what's being rejected and why, and know whether or not something 
was inappropriately rejected.


At work (.25mil to 1.5mil messages/day, depending on various things like 
day of the week, etc.), we have a system for reporting false positives. 
  The result is less than 50* false positive reports since November. 
This is among an incredibly vocal user base (professors will complain at 
the drop of a hat!).

(in both locations, messages to abuse or postmaster don't get rejected 
for spam content, and part of the false positive instructions, for 
remote senders, is to send the false positive to postmaster)

(*so, when I said less than a tenth of a percent, the reported ones are 
actually less than .000002 of all messages, less than 2 ten thousandths 
of a percent, assuming only 250k messages/day ... even if there are 500 
unreported false positives for every reported one, I'd still be within 
the range of my claim .. and then add to that 0 false positives at home, 
and a similarly low rate at another site I know is using the same code)