Exclude domain from WHOIS_MYPRIVREG?

[Greg Troxel]

I got somewhat spammy-looking ham that scored 1.7, and I'd like to fix
WHOIS_MYPRIVREG not to fire on nabble.com.  While I see the piont of
WHOIS_MYPRIVREG, I know that nabble isn't particularly a source of spam.

What I want, basically is

  domains_exclude WHOIS_MYPRIVREG nabble.com

to cause nabble.com to be not checked by the WHOIS_MYPRIVREG rule.

I looked on the wiki, and couldn't find this.

Here are headers from the mail in question:

X-Spam-Status: Yes, score=1.7 required=1.0 tests=AWL,BAYES_00,
        FORGED_YAHOO_RCVD,WHOIS_MYPRIVREG autolearn=no version=3.2.5
X-Spam-Report:
        *  1.5 WHOIS_MYPRIVREG URL registered to myprivateregistration.com
        *      [URIs: nabble.com]
        *  2.3 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
        * -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
        *      [score: 0.0000]
        *  0.5 AWL AWL: From: address is in the auto white-list

[John Hardin]

On Wed, 23 Jul 2008, Greg Troxel wrote:

>  domains_exclude WHOIS_MYPRIVREG nabble.com

Why not write a rule to see if your MTA received the message from
nabble.com and subtract a few points?

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   The difference is that Unix has had thirty years of technical
   types demanding basic functionality of it. And the Macintosh has
   had fifteen years of interface fascist users shaping its progress.
   Windows has the hairpin turns of the Microsoft marketing machine
   and that's all.                                    -- Red Drag Diva
-----------------------------------------------------------------------
  12 days until the 273rd anniversary of John Peter Zenger's acquittal

[Greg Troxel]

  >  domains_exclude WHOIS_MYPRIVREG nabble.com

  Why not write a rule to see if your MTA received the message from
  nabble.com and subtract a few points?

I suppose I could, but that would be in my view a kludge.  Basically I
think it's wrong to give positive points to a mail with a nabble.com
footer, and I'm trying to avoid doing that, rather than add a
counterbalancing score.  Subtracting seems more complex and prone to
more unintended consequences.

[John Wilcock]

Greg Troxel a écrit :
> What I want, basically is
>
>   domains_exclude WHOIS_MYPRIVREG nabble.com

AFAIK the best you can do is

uridnsbl_skip_domain    nabble.com

which excludes nabble from all URIBL lookups.

John.

--
-- Over 3000 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

[Bowie Bailey]

Greg Troxel wrote:

>   >  domains_exclude WHOIS_MYPRIVREG nabble.com
>
>   Why not write a rule to see if your MTA received the message from
>   nabble.com and subtract a few points?
>
> I suppose I could, but that would be in my view a kludge.  Basically I
> think it's wrong to give positive points to a mail with a nabble.com
> footer, and I'm trying to avoid doing that, rather than add a
> counterbalancing score.  Subtracting seems more complex and prone to
> more unintended consequences.

Then only subtract points if the email is both from nabble and hits the
whois rule.

    meta MYPRIV_NABBLE __RCVD_FROM_NABBLE && WHOIS_MYPRIVREG
    score MYPRIV_NABBLE -1.5

I'll leave it to you to write the rule to match nabble emails.

I won't argue that this is a bit of a kludge, but it works and it
shouldn't have any unintended consequences as long as the rule to match
nabble emails is solid.

--
Bowie

[Greg Troxel]

John Wilcock <john@...> writes:

> Greg Troxel a écrit :
>> What I want, basically is
>>
>>   domains_exclude WHOIS_MYPRIVREG nabble.com
>
> AFAIK the best you can do is
>
> uridnsbl_skip_domain    nabble.com
>
> which excludes nabble from all URIBL lookups.

Thank you for the suggestion - that is essentially what I want.  Were
nabble to be on some other uribl, I'd want to exclude it from that check
too.