Osirusoft question

[John Rudd]

On Wednesday, Aug 27, 2003, at 07:36 US/Pacific, Matthew Bowman wrote:

>
> Hi
>
> I commented out relays.osirusoft.com in my spam.lists.conf and reloaded
> MailScanner. However I am seeing instances of spam emails including the
> RCVD_IN_OSIRUSOFT_COM score of 0.86
>
> Which is being polled from SpamAssassins  20_head_test.cf
>
> # Osirusoft, like MAPS RBL+ is a multi-meaning BL, so it is treated
> separately
> header RCVD_IN_OSIRUSOFT_COM    rbleval:check_rbl('osirusoft',
> 'relays.osirusoft.com.')
> describe RCVD_IN_OSIRUSOFT_COM  Received via a relay in
> relays.osirusoft.com
> tflags RCVD_IN_OSIRUSOFT_COM    net
>
> The majority of e-mail i've seen today with the OSIRUSOFT score isn't
> spam
> at all.
>
> So how does one stop the OSIRUSOFT scoring? Comment it out in the .cf
> file
> and restart MailScanner?
>
> Hmm, perhaps I should  set skip_rbl_checks 1 ?
>
>


You can either do that, or you can just find all of the OSIRUSOFT rules
and
give them 0 score.   Someone mentioned them all on the spamassassin
mailing list yesterday, but I think if you grep the scores file for
OSIRU that'll find them (but may not be 100% accurate, I dunno).

If you set a rule to zero, SA doesn't check the rule, so that way you
could still do RBL checks in SA but you wouldn't have the OSIRUSOFT
ones messing up your scores.