We use Message Sniffer and the following configuration in $default$.junkmail with very good results...
SNIFFER HOLD #SNIFFER SUBJECT [SPAM:SNIFFER] RBL FOOTER [SPAM ALERT RBL - SENDER FOUND IN RBL DATABASE] DUL FOOTER [SPAM ALERT DUL - SENDER FOUND IN DUL DATABASE] RSS FOOTER [SPAM ALERT RSS - SENDER FOUND IN RSS DATABASE] #ORBSALL LOG [SPAM ALERT ORBSALL - SENDER FOUND IN ORBSALL DATABASE] #ORBSMAIN LOG [SPAM ALERT ORBSMAIN - SENDER FOUND IN ORBSMAIN DATABASE] #ORBSMAN LOG [SPAM ALERT ORBSMAN - SENDER FOUND IN ORBSMAN DATABASE] #ORBSNET LOG [SPAM ALERT ORBSNET - SENDER FOUND IN ORBSNET DATABASE] #ORBSSRV LOG [SPAM ALERT ORBSSRV - SENDER FOUND IN ORBSSRV DATABASE] OSRELAY FOOTER [SPAM ALERT OSRELAY - SENDER FOUND IN OSRELAY DATABASE] OSDUL FOOTER [SPAM ALERT OSDUL - SENDER FOUND IN OSDUL DATABASE] OSSRC FOOTER [SPAM ALERT OSSRC - SENDER FOUND IN OSSRC DATABASE] OSSMART FOOTER [SPAM ALERT OSSMART - SENDER FOUND IN OSSMART DATABASE] OSSOFT FOOTER [SPAM ALERT OSSOFT - SENDER FOUND IN OSSOFT DATABASE] MAILFROM HOLD SPAMROUTING HOLD BADHEADERS HOLD Hope this helps, _M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Jim Matuska | Sent: Monday, March 18, 2002 1:31 PM | To: [EMAIL PROTECTED] | Subject: [Declude.JunkMail] Recomended Declude Junkmail Settings | | | I am just starting to setup declude Junkmail and am looking | for some feedback as to what everyone is running for their | rules configuration. I would like to block most of the junk | that is coming into our domain but try not to block anything | legitimate. I have tried a couple different settings such as | turning on spamheaders and badheaders but seem to be picking | up a few legitimate email messages. Let me know what you can | recomend for some base settings. | | Jim Matuska Jr. | Nez Perce Tribe | Information Systems | [EMAIL PROTECTED] | | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
