Mailing List Archive

SPAM? Re: URI is counted two times
On 28 Mar 2020, at 3:09, Cecil Westerhof wrote:

> When looking at email that was marked as spam, I saw the following:
> 1.2 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
> blocklist
> [URIs: techwrestle.com]
> 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus
> DBL
> blocklist
> [URIs: techwrestle.com]
>
> Should not one of those two be removed, because it is now penalised
> two times.

That is by design.

Note that those are 2 completely distinct tests. 2 URI blacklists under
independent administration.

> It was spam, so that is not the problem, it only looks wrong to me.

Get used to it :)

SpamAssassin is not designed to use a collection of perfect binary rules
it is designed to use a collection of imperfect and possibly partially
correlated heuristic rules.

In this case, the 2 blacklists are each prone to some unknown rate of
false positives, which is why neither is weighted at 5.0. While their
true positives are probably strongly correlated, their false positives
are unlikely to be, hence it makes sense to score them both.

--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire