On the secondaries (which, as I said, there should be no legit mail going to in the first place) I at first monitored them in a separate /spambox. I still do, on the primary server. I go through all of the single and double hit DNSRBL tagged messages (I delete if an e-mail comes from an IP address listed on THREE DNSRBLs) each day. I haven't seen a false positive yet. Just spam. Maybe we don't get enough traffic for false positives to be statistically significant (or even noticeable) though. I just know that I have a mailbox with several thousand tagged pieces of spam in it, and not a single one is a legit message. Maybe I am just the luckiest mail admin on Earth though. :-)
William Van Hefner > Out of couriosity ohw are you notifed/determine what is a false > positive???? > And are you guarenteed that you know about all false positives???? > > > Kevin Bilbee > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of Travis Rabe > > Sent: Thursday, January 29, 2004 8:58 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [IMail Forum] ASSP > > > > > > John, we have discussed this before and apparently we need to > yet again. > > > > Since you are not *EMAIL OVERLOAD* people can apply policies > any way they > > see fit. What you think people should "never do" are in fact > > great policies > > on other networks. At our offices, blacklists like Spam Cop have > > yielded me > > three false positives in the past 5 months. Let's calcualte that....... > > > > Roughly 1500 emails per day per office = 7500 emails per day > > 5 months times (lets say 30 days = 150 days > > > > 7500 * 150 = 1,250,000 total e-mails > > Total Fales Positives = 3 > > > > 3/1,250,000 = .0000024 = PRETTY DAMN GOOD! > > > > > > If I were running an ISP, sure my approach may be different, > but I'm not. > > For offices that strictly prohibit anything but work related > mail blocking > > on a relaible list like SpamCop works great! Please rememeber > the way you > > run your e-mail servers isn't the way we shoudl all run ours. > > > > Thanks > > > > Travis > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] Behalf Of John > Tolmachoff > > > (Lists) > > > Sent: Thursday, January 29, 2004 8:36 AM > > > To: [EMAIL PROTECTED] > > > Subject: RE: [IMail Forum] ASSP > > > > > > > > > > I would rather just return a 5XX reject message to someone > that is on > > > > SpamCop. Let their mail admin deal with their blacklisted > > > server problems. > > > > Better them than me. I guess that all depends upon your > > religion though, > > > > and > > > > whether you lean more towards Len or Scott's viewpoint of > > what should be > > > > blocked. I see merits in both arguments, but on the most > > > reliable DNSRBLs > > > > I > > > > use, I would much rather block than waste all that processing on > > > > filtering. > > > > > > Halt. Cease. Flag on play. > > > > > > You should never ever take such an action based on a single DNS > > > based black > > > list. Haven't you heard of false positives and incorrect > > listings? Did you > > > know that for about a year, (do not know about recently,) that > > SpamCop was > > > listing Dunn & Bradstreet off and on? Turned out it was > people who were > > > having actions taken against that reported LEGIT e-mail to > > SpamCop as spam > > > and got it listed. > > > > > > John Tolmachoff > > > Engineer/Consultant/Owner > > > eServices For You > > > > > > > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
