Hi; What I have done is create combo filters for good mail servers and deduct skip certain tests if the combo filter is triggered.
Example: Filter called Good_Yahoo ------ SKIPIFWEIGHT 100 TESTSFAILED END CONTAINS [GOOD. TESTSFAILED END CONTAINS [FALSE. HEADERS END NOTCONTAINS DomainKey REVDNS END NOTENDSWITH .yahoo.com HELO END NOTENDSWITH .yahoo.com MAILFROM 0 ENDSWITH @yahoo.com MAILFROM 0 ENDSWITH .yahoo.com ------ If the above filter is triggered then RFC compliant filters are skipped. I also never add weight to a test but add weight to a combo filter that has that test in it. Example: Test called Combo_RFC_Ignorant --------------------------------------- TESTSFAILED END CONTAINS [EXCEPTION.RFC-IGNORANT] TESTSFAILED 0 CONTAINS [RFC-IGNORANT.rhsbl.NOABUSE] TESTSFAILED 0 CONTAINS [RFC-IGNORANT.rhsbl.NOPOSTMASTER] TESTSFAILED 0 CONTAINS [RFC-IGNORANT.rhsbl.DSN] TESTSFAILED 0 CONTAINS [RFC-IGNORANT.ip4r.BOGUSMX] --------------------------------------- & the Exception filters are designed to exempt certain emails from that test. In this case: [Exception.RFC-Ignorant] test is follows: ------------------------- STOPATFIRSTHIT TESTSFAILED 0 CONTAINS [EXCEPTION.LARGEISP] REVDNS 0 ENDSWITH .gmail.com REVDNS 0 ENDSWITH .hmdelivery.com REVDNS 0 ENDSWITH .hotmail.com REVDNS 0 ENDSWITH .yahoo.com . Rest deleted --------------------------------- So with this approach you can fine tune all your tests and create exceptions for those that you know always violate certain tests. The combo filter approach works great if you design your entire approach around it. The great master Matt :) got me started on this approach.. It works quite effectively. Our naming convestion for filters also allows for creating groups of filters that through wild card I can test if a single test within a family is triggered. For example: [GOOD.Yahoo] [GOOD.VERIZON] [GOOD.EARTHLINK] Now within tests I can simply search for: TESTSFAILED END CONTAINS [GOOD. Then I will exit the test if any of the Good tests is triggered. Hope that helps. Regards, - Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of mail-lists Sent: Thursday, March 16, 2006 6:20 PM To: [email protected] Subject: [Declude.JunkMail] How to let these through? Hi All, Declude is catching all these e-mails from Yahoo, but none of them are spam. All are people sending in their resumes to one of our addresses. The only thing I can think of to not have to check the spam mailbox every day is to lessen the weight for sorbs.net or the spamcop. Anybody else have any other ideas? ... --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
