HI, For what it's worth (FWIW)
For the most part, I don't catch (HOLD) and email unless it fails at least 2 tests (ie: SPAMCOP and BADHEADERS). I'm still reviewing the HOLD group and the false positives are very rare, maybe 1 in 2,000. Granted some spam is getting through, but I've noticed this spam is usually only failing one test. When an email has a WEIGHT that causes it to DELETEd, I'm 99.999% sure it really is unwanted spam. Adding Sniffer is helping quite a bit also. It does take a lot of time to a) see what is being caught b) examine the logs and/or headers to see why and then c) adjust the filters up and down to make them more effective. Since the addition of sniffer, one user has said that his spam has dropped by 2/3. I appreciate the Sniffer test being included (remmed out) in the default config files. I saved me a lot of time figuring out how to implement it. Next I need to start using MAXWEIGHT. I take it in the next beta version there will be notes in the manual and it will be included in the config files? Thanks ANdy ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, December 02, 2003 6:20 PM Subject: Re: [IMail Forum] iMail Spam, Declude and Good Mail > > >We have been using both iMail spam filtering and Declude JunkMail for a > >few months and have worked on the configuration for both constantly. For > >whatever reason, we still have a LOT of users calling about good email > >being filtered into the junk mail box. > > > >The only blacklists we are using are SpamCop and SpamHaus (both > >services). In addition we have set up statistical, phrase, HTML filtering > >in iMail and using weight filtering through Declude. Some of our users > >have set up their own rules to filter back into the MAIN box, but this > >technique is not acceptable for everyone... What else can we do to stop > >good mail from being filtering? > > The first thing to do is determine *why* the E-mails are getting > caught. From that, you can determine what to change. > > For example, E-mail from AOL, Yahoo, and Hotmail all fail the NOPOSTMASTER > and NOABUSE tests. If you're blocking mail that fails one of those tests, > you'll block a lot of legitimate mail. > > To find out what test(s) the E-mails are failing, you can either look at > the headers or the appropriate log files. > > Most likely, you have some strict spam settings that are causing this. For > example, if you block all E-mail that fails the SPAMCOP test, you'll see > occasional false positives. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
