ORBZIN ip4r inputs.orbz.org 127.0.0.2 1 0 ORBZOUT ip4r outputs.orbz.org 127.0.0.2 1 0 ORDB ip4r relays.ordb.org * 1 0 OSDUL ip4r relays.osirusoft.com 127.0.0.3 1 0 OSFORM ip4r relays.osirusoft.com 127.0.0.8 1 0 OSLIST ip4r relays.osirusoft.com 127.0.0.7 1 0 OSRELAY ip4r relays.osirusoft.com 127.0.0.2 1 0 OSSMART ip4r relays.osirusoft.com 127.0.0.5 1 0 OSSOFT ip4r relays.osirusoft.com 127.0.0.6 1 0 OSSRC ip4r relays.osirusoft.com 127.0.0.4 1 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 2 0
DORKS ip4r orbs.dorkslayers.com 127.0.0.2 1 0 DORKZTL ip4r ztl.dorkslayers.com 127.0.0.2 1 0 NJABL ip4r dnsbl.njabl.org 127.0.0.2 1 0 BADHEADERS badheaders x x 1 0 MAILFROM envfrom x x 1 0 PERCENT percent x x 2 0 REVDNS revdnsexists x x 1 0 ROUTING spamrouting x x 1 0 SPAMHEADERS spamheaders x x 1 0 WEIGHT weight x x 3 0 #WHITELIST IP x.x.x.x This works well for me. I've changed the weighing system so that a weight of 3 will trigger the action with each test being a weight of 1 or 2. I had the same problem with schools and some of our clients who we regularly receive email from being tagged as spam. I've dealt with it by adding their IP address or IP range to the WHITELIST IP. Korey ----- Original Message ----- From: "Chuck Schick" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, February 25, 2002 2:44 PM Subject: Re: [Declude.JunkMail] Problem with Symantec Act > Chris: > > Scott addressed some of the RFC issues but we have found similar problems > with mail being generated from legitimate mailing lists, cold fusion > websites, and from FrontPage forms. We have worked around some of the issue > of false positives by lowering the weights of some of the tests. REVDNS > failure is so common that we dropped the weight to 3, the same with > BADHEADERS and SPAMHEADERS and we put our weight test at 10. So with just > those 3 problems the mail will squeak by with a weight of 10. Other test > like SPAMCOP (5) and ORDB (4) will trigger issues quicker. > > I would like to hear more about what others are doing. We are playing with > the weights to try to achieve ~90+ percent spam rejection and less than 1% > false positives. The biggest cause of false positives is legitimate mail > from open relays - school district and government servers are the worst > offenders. > > Comments please. > > Chuck Schick > Warp 8, Inc. > www.warp8.com > 303-421-5140 > > ----- Original Message ----- > From: "Christopher Ulrich" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, February 25, 2002 12:03 PM > Subject: [Declude.JunkMail] Problem with Symantec Act > > > : I have a customer who has not been able to send email through our system. > He > : was scoring a "17" on the spam scale. Here's the relevant detail from the > log: > : > : 02/25/2002 13:23:37 Q811f28a BADHEADERS:8 REVDNS:4 SPAMHEADERS:5 . Total > : weight = 17 > : 02/25/2002 13:23:37 Q811f28a Msg failed BADHEADERS (This E-mail was sent > : from a broken mail client [c040020e].). > : 02/25/2002 13:23:37 Q811f28a Msg failed SPAMHEADERS (This E-mail has > : headers consistent with spam [c040020e].). > : 02/25/2002 13:23:37 Q811f28a Msg failed WEIGHT10 (Weight of 17 exceeds the > : limit of 10.). > : 02/25/2002 13:23:37 Q811f28a Msg failed WEIGHT17 (Weight of 17 exceeds the > : limit of 17.). > : 02/25/2002 13:23:37 Q811f28a Subject: test > : 02/25/2002 13:23:37 Q811f28a Message FAILED: Deleting message! > : > : Well, we determined that the person sending messages was using > : Symantec's ACT program's internal email client, and that it does not meet > : the criteria set out by Declude. > : > : I'm sure they are not the only person using Act. > : > : Has anyone seen a way around this? I don't want to raise our threshold to > : something like "18", as that will let in a flood of SPAM that is currently > : being blocked. > : However, ACT (and Maximizer, another CRM system) are widely used and need > : to work properly. > : > : Any thoughts? > : > : Thanks > : > : Chris > : > : > : --- > : [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > : > : --- > : > : This E-mail came from the Declude.JunkMail mailing list. To > : unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > : type "unsubscribe Declude.JunkMail". You can E-mail > : [EMAIL PROTECTED] for assistance. You can visit our web > : site at http://www.declude.com . > : > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
