Kim,
If you are using Declude JunkMail Pro 1.81 (the most recent release), I would try using the filters listed in a special section of my site that were designed to make use of some of the new capabilities:
http://www.mailpure.com/software/decludefilters/beta/
There are extensive comments in these filters and they are much more efficient to use. They should give you an idea about how to better use custom filters as far as techniques go. I run many more filters than I share, in part because I don't want to give away all of my secrets, and in part because my customizations that are unique to my system are hard to share in a useful manner.
I would generally recommend that you aim to not Delete messages until they are at least double your Hold score. We generally Hold at 10 or 13, and we Drop messages (effectively the same as Delete) at a score of 25, and I don't think this can be any tighter on our system. Single domain installations can be tighter, but companies with international traffic, a large userbase, or operate in certain markets prone to end users with viruses (eBayers for instance) may have to widen their ranges to be accurate.
As far as what to do, I would suggest that you identify a repeating pattern from your held messages and target that pattern. This is best accomplished using a kludge referred to as combination filters, or using END statements in a filter to pre-qualify a condition, effectively testing two conditions simultaneously. For instance, for domains with domestic traffic only, we have a filter that punishes E-mail from countries like China, Korea, Pakistan and Russia when we receive E-mail from an IP without a reverse DNS entry, which is more accurate than just targeting all of those countries and inadvertently blocking isolated instances of E-mail coming from legitimate sources. It's not perfect however.
If you keep Declude after the trial, you should also spend some money on Message Sniffer (www.sortmonster.com). It's relatively inexpensive, and it will tag +95% of your spam with about 99.8% accuracy. It might be a little hard to understand how to set it up from the documentation, but there is plenty of help around here if you ask specific questions. Pete, who owns Message Sniffer, also participates on this list. Note that I don't get any kickbacks for recommending it to others, but I do think that Pete owes me a case of beer by this point :)
Matt
Kim Premuda wrote:
We installed a trial version of JunkMail Pro about 2 weeks ago. Several days after that, we installed all the MailPure filters (recommended by Declude). The only tweak (other than the MailPure filters) we made to the '$default$.junkmail' file was to the maximum weight value as follows:
WEIGHT10 HOLD WEIGHT14 DELETE
Otherwise, everything else in the configuration file is using the default values.
We get several hundred messages a day in the 'spool\spam' folder of which approximately 90% are definitely spam. Of the 'definitely spam' messages, about half are from foreign countries. We're looking for suggestions (other filters to use, what black lists to use, adjusting the tests we already have, etc.) on how to further test messages so as to push the good message rankings below the WEIGHT10 minimum level, and the 'definitely spam' messages above the WEIGHT14 maximum level.
Thanks in advance!
-- Kim W. Premuda FastWave Internet Services San Diego, CA
-- --- [This E-mail scanned for viruses by Declude Virus]
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
