[ietf-dkim] l= statistics was 23 again (sorry John) was Output

[Murray S. Kucherawy]

> -----Original Message-----
> From: Rolf E. Sonneveld [mailto:R.E.Sonneveld at sonnection.nl]
> Sent: Friday, May 06, 2011 8:12 AM
> To: John R. Levine
> Cc: Murray S. Kucherawy; ietf-dkim at mipassoc.org
> Subject: Re: [ietf-dkim] l= statistics was 23 again (sorry John) was Output
> 
> John, the opendkim project gathers information from various sources,
> they're not necessarily the users of Murray and they're not necessarily
> subscribed to mailing lists. The statistics also doesn't tell which
> inbound mail is from legitimate sources and which inbound mail is from
> spammers/bad guys. Maybe the 95% you mention, are the spammers who try
> to abuse l= in DKIM...

Correlation against Spamassassin results is possible, though the data set is more limited because only a few reporting hosts include that extended data.  I'm not sure what this tells you but here it is:

+------------+------+------+
| l= present | pass | spam |
+------------+------+------+
|       4902 |    0 |    0 |
|        307 |    0 |    1 |
|      49265 |    1 |    0 |
|        775 |    1 |    1 |
+------------+------+------+
+------+------+------+
| l=0  | pass | spam |
+------+------+------+
| 3357 |    0 |    0 |
|  305 |    0 |    1 |
| 3386 |    1 |    0 |
|   14 |    1 |    1 |
+------+------+------+
+--------------+------+------+
| l= < msgsize | pass | spam |
+--------------+------+------+
|         4819 |    0 |    0 |
|          307 |    0 |    1 |
|        43539 |    1 |    0 |
|          768 |    1 |    1 |
+--------------+------+------+