dnswl.org

DNS Whitelist – Protect against false positives

Effectiveness of dnswl.org

The following data is an excerpt of a SpamAssassin mass-check run including one week of e-mail. Note that it contains a rather small sample and is thus not overly representative – most importantly, it will be very different in your own corpus of ham and spam:

  MSECS    SPAM%     HAM%     S/O    RANK   SCORE  NAME
      0     1183      139    0.895   0.00    0.00  (all messages)
0.00000  89.4856  10.5144    0.895   0.00    0.00  (all messages as %)
  5.219   0.1691  48.2014    0.003   0.69   -1.00  RCVD_IN_DNSWL_LOW
  2.874   0.0845  26.6187    0.003   0.62  -10.00  RCVD_IN_DNSWL_MED
  1.210   0.0000  11.5108    0.000   0.54  -100.00  RCVD_IN_DNSWL_HI
 11.195   2.1978  87.7698    0.024   0.00    1.00  __RCVD_IN_DNSWL

The SpamAssassin Wiki has a good explanation on what the columns mean in detail. The interpretation in short:

  • The _LOW rule triggered on two spams (0.1691% of 1183) and 48.2% of all hams.
  • The _MED rule triggered on one spam (0.0845% of 1183) and 26.6% of all hams. The one spam that triggered on _MED was an error in the dnswl.org data and has since been corrected.
  • The _HI rule did not trigger on any spams and 11.5% of all hams.
  • The __RCVD_IN_DNSWL rule triggered on more spams than the others which is not surprising since this also contains address ranges "under consideration". Ranges with a good standing in __RCVD_IN_DNSWL will be promoted to _LOW or _MED, while others may drop out completely.

The data above covers the period of Nov. 27 to Dec. 3 2006. Continuous effectiveness checks are performed by the SpamAssassin project as part of their Rule QA.

Menu

Language Selection

Contact

admins@dnswl.org
Please write in english, german or french - answers will be in english or german

License

Creative Commons License

$Id: effectiveness.shtml,v 1.5 2008/01/25 09:31:40 mleisi Exp $