[Mimedefang] Received headers in general

[Les Mikesell]

On Tue, May 22, 2012 at 3:31 PM,  <kd6lvw at yahoo.com> wrote:
>
>> >  Over 90% of the messages so rejected are clearly spam
>> (i.e. sent to a spamtrap mailbox) or have other problems.
>>
>> That doesn't seem like a particularly strong metric to
>> me.  What's your overall spam/non-spam ratio?
>
> In 2012, 50% to date.  My current count has 4 more spams than not.
> In 2011, 70% spam to 30% not.  I no longer have statistics for 2010 or earler.  I replaced my server with new hardware in February 2011.
>
> This counts only messages that make it to SpamAssassin scoring and are therefore accepted by the server.  Messages rejected by the MTA for any reason do not get scored.  For example, on some days, I have over 200 connections (separate addresses) rejected due to not having forward-confirmed reverse DNS entries on the incoming clients.

So 90% spam is probably not unusually high for "all mail"  -  and I
wouldn't consider finding some attribute on 90% spam, 10% non-spam
email to be a particularly useful indicator that you should reject.
Unless you like to reject just because you can.  Per rfc760 and a
concept assumed through the rfcs:: "In general, an implementation
should be conservative in its sending behavior, and liberal in its
receiving behavior."

-- 
   Les Mikesell
      lesmikesell at gmail.com



 Mail to unknown users won't be in the above counts, nor will
SPF-failed messages (rejected directly at the "MAIL FROM" SMTP state),
etc.  Of course, messages with malformed Received headers are rejected
by the MTA and not in the count either.  I do not greylist, but I do
have a fake high MX entry that always tempfails.  I do not retain my
mail rejection logs for longer than a week and delete them after I
have reviewed them so I don't have precise counts to share.
>
> I do note that more than 90% of my current spam is such because it's addressed to my spamtraps directly.  I've received only about 10 spams this year which have made it into my inbox, and those were messages which received sn SA score above my threshold but under 10.  Most of the time, the score is under 4 for non-spam and over 20 for spam, with this year's spam highscore being 83 (and a fraction).
> _______________________________________________
> NOTE: If there is a disclaimer or other legal boilerplate in the above
> message, it is NULL AND VOID.  You may ignore it.
>
> Visit http://www.mimedefang.org and http://www.roaringpenguin.com
> MIMEDefang mailing list MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang