> However, after a few years of tinkering, I > did realize that (at least based on messages > received by my mix of business clients) *I* > was able to use some tests to outright delete > 13% of all incoming mail (an additional 50% > gets deleted by weight):
> BLITZEDALL DELETE > NJABLPROXIES DELETE > AHBLPROXIES DELETE > SORBS-HTTP DELETE > SORBS-SOCKS DELETE > SORBS-MISC DELETE > MAILFROM DELETE > PERCENT DELETE Not meaning to open any old wounds, Andy, but I thought I'd chime in and share what is working for me, too. I only use a DELETE action as a reaction to something very, very specific. For example, my home-made SoBig.F filter when for a short time, we were receiving a ton of obvious bounces and virus notices from other companies that were getting faked headers with our domain name as the return address. I don't trust any 3rd party to definitively and automatically HOLD a message on its say-so alone, so I certainly wouldn't delete on that same say-so. At the very least, a delete action robs me of a way to check up on the "rightness" of the test. I balance my hold action with a decision of how long is reasonable to hold before the infromation has expired anyway and how much disk space I'm willing to spend. For me, that's 7 days. I have a little .VBS script that I picked up from the Declude Tools web page (actually points to posts here) that runs every night to delete the expired stuff. Somebody else, I just checked who (Chuck Frolick), contributed a nifty script to rotate the \imail\spool\spam folder so that you had an arbitrary day rotation, with a separate folder for each day. If I wanted to play it close, I might give XBL-DYNA a DELETE weight. Generally, I've been happy with the tests you cited, except for AHBL which I've implemented with a low weight until I have time to pay attention to it specifically. I've seen false positives with the others, including PERCENT, which rather than being an open relay "hack" was the notation used by a company using Lotus Notes on multiple platforms. Andrew 8) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
