RE: [Declude.JunkMail] Handling Held Spams
We delete held spam after 30 days. If a false positive possibility arrizes, we will use a file - search in our holding bin to identify any messages that have the correct keywords - If we verify the false positive this way we can not only put it back in stream, but also adjust our filtering scheme to compensate. This way we spend almost no time on dealing with the issue (we have very few false positives)... But when a false positive does show up we have everything we need to handle it quickly. Hope this helps, _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Mark MItchell | Sent: Wednesday, June 05, 2002 10:51 PM | To: [EMAIL PROTECTED] | Subject: [Declude.JunkMail] Handling Held Spams | | | Hello, | | I was wondering how people handle all the held spam? From | my estimates, my mailserver is holding over 1 million spams | per month. I only have BADHEADERS and MAILFROM set for hold | and rest for warn. Are those the two that most people have | set to hold? Any way to make it so the spam forwards to a | specific email address so I can search it easier if a | customer complains that there message was marked spam? | | Thanks, | Mark | | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Handling Held Spams
Do you delete automatically ? If so, how ? Cris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Madscientist Sent: Thursday, June 06, 2002 9:39 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Handling Held Spams We delete held spam after 30 days. If a false positive possibility arrizes, we will use a file - search in our holding bin to identify any messages that have the correct keywords - If we verify the false positive this way we can not only put it back in stream, but also adjust our filtering scheme to compensate. This way we spend almost no time on dealing with the issue (we have very few false positives)... But when a false positive does show up we have everything we need to handle it quickly. Hope this helps, _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Mark MItchell | Sent: Wednesday, June 05, 2002 10:51 PM | To: [EMAIL PROTECTED] | Subject: [Declude.JunkMail] Handling Held Spams | | | Hello, | | I was wondering how people handle all the held spam? From | my estimates, my mailserver is holding over 1 million spams | per month. I only have BADHEADERS and MAILFROM set for hold | and rest for warn. Are those the two that most people have | set to hold? Any way to make it so the spam forwards to a | specific email address so I can search it easier if a | customer complains that there message was marked spam? | | Thanks, | Mark | | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Handling Held Spams
VBS Scripting... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Cris Porter Sent: Thursday, June 06, 2002 10:48 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Handling Held Spams Do you delete automatically ? If so, how ? Cris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Madscientist Sent: Thursday, June 06, 2002 9:39 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Handling Held Spams We delete held spam after 30 days. If a false positive possibility arrizes, we will use a file - search in our holding bin to identify any messages that have the correct keywords - If we verify the false positive this way we can not only put it back in stream, but also adjust our filtering scheme to compensate. This way we spend almost no time on dealing with the issue (we have very few false positives)... But when a false positive does show up we have everything we need to handle it quickly. Hope this helps, _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Mark MItchell | Sent: Wednesday, June 05, 2002 10:51 PM | To: [EMAIL PROTECTED] | Subject: [Declude.JunkMail] Handling Held Spams | | | Hello, | | I was wondering how people handle all the held spam? From my | estimates, my mailserver is holding over 1 million spams per month. I | only have BADHEADERS and MAILFROM set for hold and rest for warn. Are | those the two that most people have set to hold? Any way to make it | so the spam forwards to a specific email address so I can search it | easier if a customer complains that there message was marked spam? | | Thanks, | Mark | | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Handling Held Spams
Hello, I was wondering how people handle all the held spam? From my estimates, my mailserver is holding over 1 million spams per month. I only have BADHEADERS and MAILFROM set for hold and rest for warn. Are those the two that most people have set to hold? Any way to make it so the spam forwards to a specific email address so I can search it easier if a customer complains that there message was marked spam? Thanks, Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Handling Held Spams
Hello Mark, I use a weighted system. requires a lot more then badheaders to hold a message. badheaders have a weight of 4. Need 15 to get held. We use spamreview http://www.slsoft.com/spamreview.htm to go through the held messages. In spam review we create filters that delete what is obvious spams and return into the queue what is legit messages that fallen victim to a black listed mailserver or for any other reason triggered our hold weight. It has an out of office mode that I always turn on and then in mornings when I get back to work I go through the messages for which there are currently no rules if only a single message from a special source I process it manually if there are a lot of messages from a special source I create a filter rule. Usually try to do it around lunch time and before I go home. The first few days I ran it I ended up spending a LOT of time with it but after a couple of weeks I might spend 30 minutes in the morning, 5 around lunch and 10 around evening time before I go home. Monday mornings can take a while since I generally haven't done anything since Friday afternoon before I went home. Almost every webserver mail script trips badheaders so you will catch a LOT of legit messages with that test alone. I advise against holding messages that ONLY fails badheaders. MM Hello, MM I was wondering how people handle all the held spam? From my estimates, MM my mailserver is holding over 1 million spams per month. I only have MM BADHEADERS and MAILFROM set for hold and rest for warn. Are those the two MM that most people have set to hold? Any way to make it so the spam forwards MM to a specific email address so I can search it easier if a customer MM complains that there message was marked spam? MM Thanks, MM Mark --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Handling Held Spams
Any way to make it so the spam forwards to a specific email address so I can search it easier if a customer complains that there message was marked spam? No, but this is something that plan to add soon, as it is becoming more and more frequently requested. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Handling Held Spams
Almost every webserver mail script trips badheaders so you will catch a LOT of legit messages with that test alone. I advise against holding messages that ONLY fails badheaders. You're thinking of SPAMHEADERS (legal, but spamlike, headers not seen coming from legitimate mail clients). Lots of web mail scripts (the ones from the companies where the boss says Yeah, we can build it ourselves! We'll save money!) fail the SPAMHEADERS test. Very few web scripts fail the BADHEADERS (headers that are both illegal and spamlike, not seen coming from legitimate mail clients) test, though. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
