Hello Mark, I use a weighted system. requires a lot more then badheaders to hold a message. badheaders have a weight of 4. Need 15 to get held. We use spamreview http://www.slsoft.com/spamreview.htm to go through the held messages. In spam review we create filters that delete what is obvious spams and return into the queue what is legit messages that fallen victim to a black listed mailserver or for any other reason triggered our hold weight. It has an out of office mode that I always turn on and then in mornings when I get back to work I go through the messages for which there are currently no rules if only a single message from a special source I process it manually if there are a lot of messages from a special source I create a filter rule. Usually try to do it around lunch time and before I go home. The first few days I ran it I ended up spending a LOT of time with it but after a couple of weeks I might spend 30 minutes in the morning, 5 around lunch and 10 around evening time before I go home. Monday mornings can take a while since I generally haven't done anything since Friday afternoon before I went home.
Almost every webserver mail script trips badheaders so you will catch a LOT of "legit" messages with that test alone. I advise against holding messages that ONLY fails badheaders. MM> Hello, MM> I was wondering how people handle all the held spam? From my estimates, MM> my mailserver is holding over 1 million spams per month. I only have MM> BADHEADERS and MAILFROM set for hold and rest for warn. Are those the two MM> that most people have set to hold? Any way to make it so the spam forwards MM> to a specific email address so I can search it easier if a customer MM> complains that there message was marked spam? MM> Thanks, MM> Mark --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
