John, I appreciate all of the feedback you provide to the Declude community but in all honesty I don't feel like you read my e-mail at all.
If you look at the headers I included you will see that I am NOT using the SPAMDOMAINS test on our own domains. I am using SPAMDOMAINS on MINDSPRING.COM which is a big (not free) e-mail service. In addition I wasn't asking for feedback on the tests I am using for weighting. I am fully aware that they could be made more clear. All I'm trying to do is learn more about the "locations" which are used with the FILTER test type. In the headers of the message below you can see that someone sent an e-mail to [EMAIL PROTECTED] and it was immediately forwarded from the current ISP for bigfishing.com over to our mail server. Declude Junkmail saw the name "mindspring.com" which is on it's SPAMDOMAINS list and since it's not from a "mindspring.com" server it added some points. That's fine. That's exactly how it's supposed to work. What I would like to do is create a filter, an exception if you will, so that any mail which is sent to [EMAIL PROTECTED] and is forwarded to our mail system from the recipient SMTP host automatically subtracts some points for [EMAIL PROTECTED] Since there isn't a MAILTO filter "location", and there's no concise description in the documentation of what exactly the other filtering "locations" (BODY, HEADERS, HELO, MAILFROM, > REMOTEIP, REVDNS, ALLRECIPS and SUBJECT) cover I was looking for some feedback from the community about how they would handle making an exception for this message. Specifically I was asking for a text string and filter "location" that they would accomplish that. Thanks, Dan Geiser [EMAIL PROTECTED] ----- Original Message ----- From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, October 03, 2003 11:42 AM Subject: RE: [Declude.JunkMail] Using Filter "Locations" Beyond MAILFROM First, others have stated and I agree SPAMDOMAINS should not be used with your own domains for a couple of reasons. The test was basically designed for the free type big mail services. Second, you need to redo your weight tests. You have a lot of overlapping and redundant tests configured. >From what I gather from your confusing tests, what you want is the following: WEIGHT6 WEIGHT7 WEIGHT8 WEIGHT9 WEIGHT10 WEIGHTRANGE11-39 WEIGHTRANGE40-49 7 replacing 16, each message only triggering one test. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Dan Geiser > Sent: Friday, October 03, 2003 7:34 AM > To: Declude JunkMail > Subject: [Declude.JunkMail] Using Filter "Locations" Beyond MAILFROM > > Hello, All, > I have a situation that I was hoping to get some feedback on. We have an > e-mail user who is using our spam filtering service. They have a domain > name setup with an outside e-mail hosting provider and all of the e-mail > that is sent to that domain name gets forwarded over to his account that is > hosted with us. Because of this forwarding all domains which are defined in > our "spam domains" list get flagged as coming from the wrong mail server and > weight is added on to the message pushing it over the "hold weight" even > though if the message would've been delivered directly to us it would've > been fine. (See below involving MINDSPRING.COM) > > Unless there's a more better way to to do this involving a different type of > test, and please tell me if there is, I would like to create a FILTER that > looks for a certain string and subtracts a few points based on that string. > So far my the sum total of my experience with filter is using MAILFROM as my > "location" in the filter. Based on the header information below, what would > be the best "location" to use in my filter and what would be the best string > to search for in that location? Are BODY, HEADERS, HELO, MAILFROM, > REMOTEIP, REVDNS, ALLRECIPS and SUBJECT the only locations available for > use > in a filter? Since I'm basically making this exception for just one > situation (unless others come up later) I would like to use the solution > that adds the last amount of additional overhead to the spam-filtering > system. > > Thanks For Your Feedback! > Dan Geiser [EMAIL PROTECTED] > > P.S.: Some Names Have Been Changed to Protect the Innocent > > ==================================== > Received: from extremehosting.com [64.106.222.10] by danstitleagency.com.com > (SMTPD32-6.06) id A7C83A700F4; Thu, 02 Oct 2003 09:27:36 -0400 > Received: (qmail 8871 invoked by uid 89); 2 Oct 2003 13:27:37 -0000 > Delivered-To: [EMAIL PROTECTED] > Received: (qmail 8852 invoked from network); 2 Oct 2003 13:27:34 -0000 > Received: from stork.mail.pas.earthlink.net (207.217.120.188) > by 64.106.222.242 with SMTP; 2 Oct 2003 13:27:34 -0000 > Received: from user-0cdv5be.cable.mindspring.com ([24.223.149.110] > helo=JohnDoe) > by stork.mail.pas.earthlink.net with asmtp (Exim 3.33 #1) > id 1A53TP-0000ia-00 > for [EMAIL PROTECTED]; Thu, 02 Oct 2003 06:26:27 -0700 > Message-ID: <[EMAIL PROTECTED]> > Reply-To: "John Doe" <[EMAIL PROTECTED]> > From: "John Doe" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Subject: topic > Date: Thu, 2 Oct 2003 09:23:15 -0400 > MIME-Version: 1.0 > Content-Type: multipart/mixed; > boundary="----=_NextPart_000_0038_01C388C6.CF556C50" > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2800.1158 > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 > X-ELNK-Trace: > 097c147a6b3c29b49649176a89d694c0f43c108795ac4507ebfb9684c58d7b9521d9 > 79922ded > d6f1350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c > X-RBL-Warning: SPAMDOMAINS: Spamdomain '@mindspring.com' found: > Address of > [EMAIL PROTECTED] sent from invalid mail.extremehosting.com. > X-Declude-Sender: [EMAIL PROTECTED] [64.106.222.10] > X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for > spam. > X-Spam-Tests-Failed: IPNOTINMX, WEIGHT05, WEIGHT07, WEIGHT08, > WEIGHT09, > WEIGHT10, WEIGHTRANGE05-39, WEIGHTRANGE07-39, WEIGHTRANGE08- > 39, > WEIGHTRANGE09-39, WEIGHTRANGE10-39, WEIGHTRANGE05-49, > WEIGHTRANGE07-49, > WEIGHTRANGE08-49, WEIGHTRANGE09-49, WEIGHTRANGE10-49, > SPAMDOMAINS [10] > ==================================== > > ----------------------------------------------------------------------- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ----------------------------------------------------------------------- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan ----------------------------------------------------------------------- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
