35 lines
1.8 KiB
Plaintext
35 lines
1.8 KiB
Plaintext
 
|
# Second-pass reality check (SPEC §C.1: this filter runs on mail the provider has
|
||
|
|
# already accepted and delivered).
|
||
|
|
#
|
||
|
|
# Every symbol below is a legitimate SMTP-time signal that is meaningless — or
|
||
|
|
# actively wrong — when scoring a message at rest, days after delivery, fetched
|
||
|
|
# over IMAP. Measured on a 398-message sample of real delivered mail, they fired
|
||
|
|
# on 44-71% of it and pushed 11.3% of ordinary mail over the banner threshold.
|
||
|
|
#
|
||
|
|
# They are zeroed, not deleted: they still appear in the symbol list, so a verdict
|
||
|
|
# stays explainable, they just no longer contribute score. When M6 lands, the edge
|
||
|
|
# scanner (§C.7) sees real SMTP state and these matter again — there, not here.
|
||
|
|
#
|
||
|
|
# Measured on 398 real delivered messages, before -> after this file:
|
||
|
|
# median 3.09 -> 0.70
|
||
|
|
# p95 7.00 -> 3.40
|
||
|
|
# >= 6.0 11.3% -> 1.0% (the banner threshold)
|
||
|
|
# max 11.66 -> 9.15 (move threshold is 12.0, so: headroom)
|
||
|
|
# The thresholds themselves were left at the spec's 12.0/6.0 — they were never
|
||
|
|
# the problem. Re-measure after the C2 learning loop has a trained Bayes: until
|
||
|
|
# then genuine scams and legitimate bulk mail overlap in the 5-8 band, and no
|
||
|
|
# threshold can separate them.
|
||
|
|
symbols {
|
||
|
|
# "This message is older than the scan" — always true for us.
|
||
|
|
"DATE_IN_PAST" { score = 0.0; }
|
||
|
|
# "Already delivered once" — by definition, for a second-pass filter.
|
||
|
|
"PREVIOUSLY_DELIVERED" { score = 0.0; }
|
||
|
|
# Properties of the connecting host, which we never saw.
|
||
|
|
"HFILTER_HOSTNAME_UNKNOWN" { score = 0.0; }
|
||
|
|
"RCVD_NO_TLS_LAST" { score = 0.0; }
|
||
|
|
# Absence-of-authentication penalties. We cannot verify SPF/DKIM/DMARC/ARC at
|
||
|
|
# rest anyway, so "not available" says nothing about this message.
|
||
|
|
"ARC_NA" { score = 0.0; }
|
||
|
|
"DMARC_NA" { score = 0.0; }
|
||
|
|
}
|