Hello Mike, Thanks for sharing your Configuration. I like your "three strikes out" approach. I use the same approach but with slightly different set of values. I find it very interesting that some of us can HOLD and look at each e-mail. We process 75,000 to 110,000 per day. So I also have to be conservative while catching as much SPAM as possible. And surely don't have time to check 80,000 to 90,000 e-mails.
I ordered sniffer this morning and hope to use it to add to the total Declude weight. I expect I'll stay with the three strike rule. But if sniffer is as good as advertised, I hope is to be able to raise the points (i.e. sniffer and any other test and your out). Thanks again for sharing your approach. And thanks to the group for all the good info. Ken ----- Original Message ----- From: "Mike Nice" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, February 01, 2002 10:26 AM Subject: Re: [Declude.JunkMail] Comparing Weight Configurations > OSRELAY 5 0 > OSDUL 5 0 > OSSRC 5 0 > OSSMART 5 0 > OSSOFT 5 0 > OSLIST 5 0 > OSFORM 5 0 > ORDB 5 0 > SPAMCOP 5 0 > DSN 5 0 > NOPOSTMASTER 5 0 > NOABUSE 5 0 > BADWHOIS 3 0 > IPWHOIS 3 0 > > MAILFROM envfrom x x 2 0 > BADHEADERS badheaders x x 0 0 > SPAMHEADERS spamheaders x x 3 0 > ROUTING spamrouting x x 9 0 > REVDNS revdnsexists x x 5 0 > CATCHALLMAILS catchallmails x x 0 0 > > WEIGHT15 weight x x 15 0 > > > > ALONG WITH WHITELIST for Microsoft (king of the RFC-Ignorant) passport and > expedia mailers - > > WHITELIST FROM [EMAIL PROTECTED] > WHITELIST FROM @msnnewsletters.customer-email.com > WHITELIST FROM @expedia.com > > > My goal is to minimize the number of false-positives to near zero. I had > to back down the BADHEADERS and SPAMHEADERS because they mostly represent > automated mailing programs. There are many of these in use all over for > legitimate purposes - shopping carts, confirmations, signups, etc that > people want to receive. I'm sure Spammers monitor this list and have > already made their mailblaster headers to mimic MS Outlook and be > RFC-Compliant. But admittedly, there are still a bunch of losers running > the old spam blasting software though. > > The only remaining false positives are related to the obligitory self-run > E-mail system that many small companies want to run. Of course they have no > reverse DNS, they are open relay, and because of the open relay they end up > in the Spamcop database. Normally, this 3-strikes would be considered spam. > There have been a number of these from local companies that I had to > whitelist because the E-mail customer would expect delivery or a bounce > message. > > I could back down ORDB weighting if I add the sniffer technology to the > mix. > > > ----- Original Message ----- > From: "Don Schreiner" <[EMAIL PROTECTED]> > To: "Declude List" <[EMAIL PROTECTED]> > Sent: Friday, February 01, 2002 8:11 AM > Subject: [Declude.JunkMail] Comparing Weight Configurations > > > > Anyone want to compare/share some of their successful weighting > > configurations? > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
