Re: [Declude.JunkMail] SpamDomains

[Matthew Bramble]

Well that and at least 10 other filters that have been shared on this 
list or available at my site.  It really depends on how tight you want 
your system of course and how much processing power you can throw at 
things.  The recent beta functionality to limit the processing of 
filters helps a bunch though.  Filters helped me to get my system to 
over 98% blocking while lowering my FP rate, and of course I'm deleting 
much more E-mail now that comes in well above my delete weight.  I fail 
at 10, currently delete at 30, but 80% to 90% of the spam is scoring 
higher than that.

Again though, you can do up to maybe 95% with the standard version if 
you tweak it carefully, which is just fine for many companies.  It would 
be nice if Scott would add REVDNS pseudo-whitelisting by points to the 
standard version, that's kind of basic IMO.

Matt



Jason wrote:

Ahh, but us poor folks that have the standard version are out of luck
:-(
Guess I have a good reason to upgrade now.	

Jason



-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Wednesday, December 03, 2003 9:17 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SpamDomains
Jason,

I have a separate 'white' filter for that sort of thing :)

Matt



Jason Newland wrote:

 

I don't know how hard it would be, but what about just adding in a 
"pre" filter in the spamdomains test that will bypass the test.  Like:

Spamdomains.txt:

[RDNS excluded from check]

ebay.com
greetingcardvendor.com
[includes]
.yahoo.com
@msn.com
etc, etc
This would also allow us to build our list of acceptable excluded 
addresses together, further improving the tests accuracy.

Jason



---------- Original Message ----------------------------------
From: Matthew Bramble <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Wed, 03 Dec 2003 19:38:18 -0500


   

Alejandro,

     

From the Declude JunkMail manual page:
   

 "This test will catch E-mail that is not coming from a mailserver
 that it should be coming from. This test will only work if you set
 up a file listing domains that you wish to be included in this
     

test.
 

 Specifically, it will check the return address of the E-mail, and
 then check to see if the reverse DNS entry of the IP that the
     

E-mail
 

 was sent from contains the domain name. If not, the E-mail fails
     

the
 

 test. For example, if "hotmail.com" is listed in the
 \IMail\Declude\spamdomains.txt file, then an E-mail coming from
 "law2.hotmail.com" would not fail the test, but an E-mail from
 "mail.example.ru" would fail the test."
You can search the archives for some discussions of this.  It's hardly
foolproof, things like greeting cards and send-a-link sites will often
     

 

fail the test because they send E-mail with a MAILFROM address of the 
person sending the note and not the service sending the note.  I
     

suggest 
 

that you always use the @ symbol in the first column, and you should
     

set 
 

up two different files and score them differently.  One should be for 
ISP's and E-mail providers such as AOL, HotMail, Yahoo, etc., and the 
other should be for businesses that are often spoofed such as
     

Microsoft, 
 

PayPal, Symantec/Norton, McAfee.  Be careful not to include companies 
that may use thrid-party mass mailers for newsletters.  The second
     

type 
 

of test can be scored higher because you are less likely to be getting
     

 

greeting cards from people with real addresses at these companies than
     

 

you are from places like AOL.

You might also be thinking of including your own domains in this test,
but that again should be in a totally different file, and scored very 
low because even if you are using WHITELIST AUTH functionality, you
     

will 
 

most definitely get users sending E-mail with your hosted addresses 
configured in their E-mail program but are using someone else's mail 
server, or without WHITELIST AUTH, they will fail when using your own 
mail server.

Matt

  
     



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.