The following is a list of tests that we run against the E-mails arriving at the spamtraps, and what percentage of the spam they caught (it may be easier to read if you use a fixed-width font):
WEIGHT10 99.59% WEIGHT20 97.70% NOLEGITCONTENT 97.54% SPAMMANAGER 95.45% SNIFFER 94.07% IPNOTINMX 93.07% SPAMCHK 92.49% SPAMCOP 78.80% MAILDEFLECTOR 69.09% DSBLALL 60.72% DSBL 60.52% BLARSBL 50.28% NOABUSE 44.99% BADHEADERS 41.33% FIVETENSRC 40.46% NOPOSTMASTER 37.13% NJABLPROXIES 28.93% REVDNS 27.96% HELO 25.34% ROUTING 20.95% RSL 15.34% SPAMHAUS 14.98% IPWHOIS 14.55% XBL 13.79% SPAMHEADERS 11.23% DSN 9.68% BLITZEDALL 9.46% NJABLSOURCES 9.34% COMMENTS 9.10% BASE64 7.21% FABELSOURCES 5.08% NJABLDUL 5.03% LNGSDUL 4.63% FIVETENIGNORE 2.80% SPAMBAG 2.69% MAILFROM 2.65% BADWHOIS 2.22% NJABL 2.09% VOX 1.97% INTERSIL 1.46% ORDB 1.40% DNSRBL-DUN 0.62% PIGS 0.61% FIVETENOPTIN 0.60% JIPPG-DUL 0.53% LNGSBLOCK 0.44% KUNDENSERVER 0.40% NONENGLISH 0.38% DSBLMULTI 0.26% KITHRUP 0.21% DNSMAILLIST 0.13% DEVNULL 0.04% FIVETENMULTI 0.04% FIVETENOTHER 0.03% JIPPG-DULJP 0.01% FLOWGO 0.00% FIVETENWEBFORM 0.00% LNGSSRC 0.00%
The WEIGHT10 and WEIGHT20 tests are a weighting system that assigns a weight to each E-mail, based on the spam tests that fail, so they don't really count as spam tests by themselves (but, they show that you can catch as much as 97-99+% of spam with extremely few false positives, and without relying on a single spam test). It is also important to note that different tests are more likely to produce false positives (such as the IPNOTINMX, REVDNS, and SPAMHEADERS tests, that all catch a lot of spam, but catch a lot of legitimate mail as well); those tests need to be used in a weighting system, so E-mail will only be marked as spam if it fails a combination of tests. The NOLEGITCONTENT and IPNOTINMX tests were designed to help identify legitimate E-mail (rather than spam), which accounts for their high percentages.
It is interesting to note that at least 41% of the spam in November could safely be caught by the BADHEADERS test (since no RFC-compliant mail client will send out E-mail that fails the BADHEADERS test).
There are 3 spam tests that catch over 90% of the spam in our spamtraps: SNIFFER ( http://www.sortmonster.com ), SPAMMANAGER ( http://www.spammanager.com ), and SPAMCHK ( www.spamchk.com ) (at its strictest setting).
More information on most of the spam tests shown above can be found at http://www.declude.com/junkmail/support/ip4r.htm . You can look up an IP address using the Spam Database Lookup tool at http://www.DNSstuff.com to see what spam databases it is listed in. The most recent 20 spams in our spamtraps, and the tests they failed, can be found at http://www.declude.com/spamtrap.htm .
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
