The only reason I ask about if I should "learn" the messages is that my users have a hard time putting good email into the good email folder. Everyone is quick to put in spam messages though. My filter is getting about 50 to 1 spam to ham right now. Everything I've read/heard states that I should try to be close to 1 to 1 for optimum spam hits. If I add this into the learn then I'll be shooting up the filter to close to 100 to 1 (or more). Should I be worried about that?
-----Original Message----- From: Giampaolo Tomassoni [mailto:[EMAIL PROTECTED] Sent: Thursday, August 16, 2007 9:43 AM To: Johnson, S; [email protected] Subject: R: Blacklist mail > Da: Johnson, S [mailto:[EMAIL PROTECTED] > > A few months ago I created a fake user and advertised it > in a hidden mailto on our home page. It took a few weeks > but I'm getting good spam messages being dropped into this > box now. I know I can use the learn function to pull the > messages from my exchange server, however I know these > messages are strong spam. Should I just use the learn > function or is there a way to blacklist the servers sending > these messages? (or is there a better method?) Reporting is fine. Make sure you run "sa-learn --spam" with the same user you run spamassassin. Also, you may think enabling reporting to DCC, Razor and Pyzor, since they allow auto-reporting from spamtraps. Also, contact SpamCop and tell 'em you've got a good spamtrap: they will instruct you about how to route messages to them in order to mark the sender in their RBL (this is not the same route then reporting with spamcop). Giampaolo
