We've been pretty fortunate in that the majority of spam that we receive is fairly successfully handled by IMail anti-spam filtering. However, I've got a handful of users, who continue to receive quite a bit of spam no matter how I modify things. Is there anything that I'm missing that would cause individual mail accounts to be treated differently by the spam filters than others?
The first thing to check is to see if they are "quasi-legitimate" -- spam that the user actually agreed to receive. Some signs to look for are IPs that aren't listed in many spam databases, but that have reverse DNS entries that match the domain in the return address and HELO/EHLO. For example, if the top Received: header is:
Received: from mail.cool_offers.com [192.0.2.25] by mail.my_domain.com with ESMTP
(SMTPD32-8.04) id A094C9B012A; Sun, 23 Nov 2003 11:30:24 -0500
and 192.0.2.25 has a reverse DNS entry of "mail.cool_offers.com" (or even "mx1.cool_offers.com" that doesn't match the HELO/EHLO, but uses the same domain), and the E-mail is sent from "[EMAIL PROTECTED]", there is a very, very good chance that the user actually agreed (intentionally or not) to receive it. If only a handful of users are receiving a lot of spam while everyone else is receiving little spam, this is probably what is happening. Typically it happens when people give out their E-mail address a lot, and don't bother or rarely bother to uncheck boxes that say something like "Please give my E-mail address to your partners."
In this case, the best option is usually to simply unsubscribe. These quasi-legitimate mailers will definitely unsubscribe -- that's one of the ways they are able to get away with sending the spam and keeping their Internet access. That's also part of the reason why they don't fail many spam tests. The other way would be to use a tool that analyzes the content of the E-mail, such as Message Sniffer.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
