In my view, the best thing to do is examine spam that got through. When you find a pattern in several messages, use that info to tweak Declude. I've been tweaking ours for months, to the point that each day I find less than 30 messages in our hold box. First I look through those for any legitimate mail that got caught (rare). Then I delete any spam that only shows up once; no time to mess with it. Of the remaining items that are multiple messages from the same spammer, I look at the header and body to find out what I should be filtering on.
Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Thursday, July 17, 2003 9:01 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Best Practices question > > > > >Being a 2 months-old user of JunkMail I'm trying to find out "best > >practices" for dealing with spam. Sorry in advanced if this topic > >has been to death, but I couldn't find any helpful threads > on the archives. > >Anyhow, I'm using the following rules but a TON of spam > still making it > >through: > >WEIGHT10 WARN > >WEIGHT15 HOLD > >WEIGHT20 HOLD > > > >Of course, the spam comes through because it doesn't meet > the HOLD criteria. > > My first question would be "Is there a ton of spam being caught?" If > you're blocking 1,000 spams to your personal account a day > and 50 spams get > through, that's not too bad. If you're only blocking 100 > spams and 50 get > through, that's a problem. > > If it's the later -- where a large percentage of spam is > getting through -- > there is probably a problem with some of the tests. Does the > log file > report a lot of warnings or errors? Does the first DNS > server listed in > the IMail SMTP settings work properly? Do you have a gateway > or backup > mailservers that run in front of the IMail server? > > -Scott > --- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
