Hi Chris, I like your approach. It is what we have called before three strikes and your out. From your list of weight, it takes about three of anything to delete an e-mail.
My only comment is SPAMCOPS seem a bit high at 10, although they are good, it is too easy for a good mail server to be listed by a jerk user with an ax to grind. And ORBZIN & ORBZOUT should not have the same weight. Most servers that get listed by ORBZ are listed both in and out. That tends to give ORBZ the effective weight of 10 (I use 5 in, and 2 out) even the ORBZ folks recommend that you only look at one (usually the in). I really like the "sniffer" from SortMonster. I like their approach and accuracy. Just my 2 cents. And a big thanks to the group for all it's help via this list. Thanks to Scott also. Ken - FIAM Support ----- Original Message ----- From: "Christopher Ulrich" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, February 26, 2002 10:00 AM Subject: Re: [Declude.JunkMail] Problem with Symantec Act - SAMPLE SETTINGS > I've tweaked our settings and are testing the following. > Anyone have any feedback either way on why any of this is too high, > too low, would let too much past, or would create too many false positives? > > ORBZIN ip4r inputs.orbz.org 127.0.0.2 5 0 > ORBZOUT ip4r outputs.orbz.org 127.0.0.2 5 0 > ORDB ip4r relays.ordb.org * 5 0 > OSDUL ip4r relays.osirusoft.com 127.0.0.3 5 0 > OSFORM ip4r relays.osirusoft.com 127.0.0.8 5 0 > OSLIST ip4r relays.osirusoft.com 127.0.0.7 5 0 > OSRELAY ip4r relays.osirusoft.com 127.0.0.2 5 0 > OSSMART ip4r relays.osirusoft.com 127.0.0.5 5 0 > OSSOFT ip4r relays.osirusoft.com 127.0.0.6 5 0 > OSSRC ip4r relays.osirusoft.com 127.0.0.4 5 0 > SPAMCOP ip4r bl.spamcop.net 127.0.0.2 10 0 > > DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 5 0 > NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 5 0 > NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 5 0 > > BADHEADERS badheaders x x 3 0 > MAILFROM envfrom x x 8 0 > PERCENT percent x x 10 0 > REVDNS revdnsexists x x 3 0 > ROUTING spamrouting x x 5 0 > SPAMHEADERS spamheaders x x 3 0 > > ... > > WEIGHT10 weight x x 10 0 > WEIGHT13 weight x x 13 0 > > WEIGHT10 WARN > WEIGHT13 DELETE > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
