Which of these AS features have the least false positives?
Verify Mail From
A MAILFROM test will never have false positives, except when a mail client is set up incorrectly (in a way that the sender will never receive bounce messages, and probably never even receive replies).
Perform DNS Lookup for connecting server
For a reverse DNS test, we've seen rates ranging from about 10% to 25% of legitimate mailservers having no reverse DNS entry.
Verify HELO/EHLO Domain
In theory, this should never have any false positives. However, most mail clients will send bogus HELO/EHLO information (such as "hostname" or "localhost"). So this must be used carefully.
We recommend that our customers not block on any of these, but use them in a weighting system (with MAILFROM weighted very high, and REVDNS/HELOBOGUS weighted fairly low).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
