Re: Mail filtering of the IMPACT Conference Report

From: Ron Guerin <ron_at_madworx.com>
Date: Wed 08 Mar 2006 16:19:20 -0600

Cliff Kurtzman wrote:
> With the mailing that we sent out Monday, we got notice from
> one company with three subscribers on the list, telling us the
> delivery had been blocked for inappropriate content, and
> detailing the "grading" criteria used by the software to block
> the message. I thought it would be useful to share the message
> with the list so folks can get an idea of how (at least this one)
> filtering program works:
>
> Content analysis details: (8.3 points, 5.0 required)
>
> pts rule name description
> ---- ---------------------- --------------------------------------------------
> 0.0 TO_ADDRESS_EQ_REAL To: repeats address as real name
> 0.5 HTML_40_50 BODY: Message is 40% to 50% HTML
> 0.1 HTML_FONTCOLOR_UNKNOWN BODY: HTML font color is unknown to us
> 0.3 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area
> 0.1 HTML_FONTCOLOR_BLUE BODY: HTML font color is blue
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 0.7 HTML_TABLE_THICK_BORD BODY: HTML table has thick border
> 0.1 HTML_FONTCOLOR_UNSAFE BODY: HTML font color not in safe 6x6x6 palette
> 5.5 PO^RN_4 URI: URL uses words/phrases which indicate po^rn
> 0.2 TLM_URI_amp0 URI: URI contains something to block
> 0.8 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
>

[snip]

> The big deduction was for 5.5 points. All the other deductions
> together would not have been enough to trigger the blocking, but
> that single deduction alone was sufficient to cause the message
> to not be delivered to those three recipients. The reason for
> that deduction was:
> URL uses words/phrases which indicate po^rn
> I've gone back through the message to look at each of the URLs,
> and all I can figure is that the software thinks that "impact" is
> a dirty word.
>
> I'm amazed that people would buy software that works this way.

You really shouldn't be. That software consistently rates #1 in its
category (see Datamation's annual survey), because it works very well.

Note that how the software is configured to score mail is entirely
up to its operator, and the scores above are not universal. For
example, I cannot locate

    5.5 PO^RN_4 URI: URL uses words/phrases which indicate po^rn

in my copy of this software, and thus it is almost certainly a local
rule, possibly a poorly-written one at that, or some 3rd party plugin.

For example, my system with this same software, scored the same message:

X-Spam-Status: No, score=3.25 required=4.9 tests=AWL,BAYES_50,BIZ_TLD,
        HTML_40_50,HTML_MESSAGE,ISO_7BITS,J_CHICKENPOX_24,
        MR_STRANGE_QUESTION, SARE_SPEC_LEO_PHARM2,
        _FVGT_b_OBFU_HTML autolearn=no version=3.1.0

- Ron





Received on Wed Mar 08 2006 - 16:19:20 CST