1 in 500,000? That's fantastic. I think that qualifies for the anti-spam guru of the week award!
heh, that is no exageration either, it is mainly due to spending alot of time in looking at false positives and finding ways to prevent them. For example use filtering to look for legit mail, the attached filter file runs before all other filters, it contains things that I found in false positives. This file is my number one false positive eliminator, my second method is test the hell out of any significant changes first. I do have the luxury of having to only filter for one company and I can be fairly restrictive....
I will see if I can get my configs somewhere for download, I am willing to share my work because I hate spam and spammers so much... man do i hate them.
Rick Davidson
National Systems Manager
North American Title Group
-
# Anti Anti-Spam # # This file is used to identify things in messages that don't # normally appear in spam to stop filtering processes. # TESTSFAILED END CONTAINS SENDERDB TESTSFAILED END CONTAINS ORDB TESTSFAILED END CONTAINS KUNDEN
BODY STOPALLTESTS CONTAINS .csv
BODY STOPALLTESTS CONTAINS .doc"
BODY STOPALLTESTS CONTAINS .EDS"
BODY STOPALLTESTS CONTAINS .PDF
HEADERS STOPALLTESTS CONTAINS .PDF
BODY STOPALLTESTS CONTAINS .dtx"
BODY STOPALLTESTS CONTAINS .dwg"
BODY STOPALLTESTS CONTAINS .GMD"
BODY STOPALLTESTS CONTAINS .LSD
BODY STOPALLTESTS CONTAINS .MRF
BODY STOPALLTESTS CONTAINS .rtf"
BODY STOPALLTESTS CONTAINS .TIF"
BODY STOPALLTESTS CONTAINS .UP"
BODY STOPALLTESTS CONTAINS Content-Type: application/applefile
BODY STOPALLTESTS CONTAINS Content-Type: application/mol
BODY STOPALLTESTS CONTAINS Content-Type: application/msword
BODY STOPALLTESTS CONTAINS Content-Type: application/octet-stream;
BODY STOPALLTESTS CONTAINS Content-Type: application/pdf
BODY STOPALLTESTS CONTAINS Content-Type: application/rtf
ANYWHERE STOPALLTESTS CONTAINS Content-Type: image/tiff
BODY STOPALLTESTS CONTAINS Content-Type: application/vnd.ms-excel
BODY STOPALLTESTS CONTAINS Content-Type: application/vnd.ms-powerpoint
BODY STOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed
BODY STOPALLTESTS CONTAINS X-MS-Attachment:
#
SUBJECT STOPALLTESTS CONTAINS [Declude
SUBJECT STOPALLTESTS CONTAINS [Imail
SUBJECT STOPALLTESTS CONTAINS [ciblist
SUBJECT STOPALLTESTS CONTAINS Closing Docu
SUBJECT STOPALLTESTS CONTAINS Commence sync data
SUBJECT STOPALLTESTS CONTAINS Documents For
BODY STOPALLTESTS CONTAINS digitaldocs
BODY STOPALLTESTS CONTAINS E-TICKET BODY STOPALLTESTS CONTAINS Note: forwarded message attached
BODY STOPALLTESTS CONTAINS Orbitz Travel Document
BODY STOPALLTESTS CONTAINS marriott.com/property
BODY STOPALLTESTS CONTAINS marriott.com/reservation
BODY STOPALLTESTS CONTAINS Your files are attached and ready to send with this message
#
HEADERS STOPALLTESTS CONTAINS CareerBuilder.com
MAILFROM STOPALLTESTS CONTAINS @Dell.com
MAILFROM STOPALLTESTS CONTAINS @LENNAR.COM
MAILFROM STOPALLTESTS CONTAINS @UAMC.COM
BODY STOPALLTESTS CONTAINS www.natreach.com
HEADERS STOPALLTESTS CONTAINS KODAK EasyShare
HEADERS STOPALLTESTS CONTAINS reacheach1.com
#
# Psuedo whitelist
#
ANYWHERE STOPALLTESTS CONTAINS smtp.expedia.com
ANYWHERE STOPALLTESTS CONTAINS @aa.globalnotifications.com
ANYWHERE STOPALLTESTS CONTAINS datascope.com.ph
ANYWHERE STOPALLTESTS CONTAINS DeltaElectronicTicketReceipt
HEADERS STOPALLTESTS CONTAINS .homes.com
BODY STOPALLTESTS CONTAINS isellfortcollins.biz
BODY STOPALLTESTS CONTAINS Travelocity Reservation
ANYWHERE STOPALLTESTS CONTAINS .united.com
ANYWHERE STOPALLTESTS CONTAINS .us.dell.com
ALLRECIPS STOPALLTESTS CONTAINS @iwon.com
