RE: [Declude.JunkMail] Help with 'fromfile'

2003-12-05 Thread T. Bradley Dean
Aha! Another one hasn't been sent yet, but I think I see it already:

12/05/2003 14:17:34.980 Q03fd3cc fromfile: Starting BLOCKEDSENDERS
12/05/2003 14:17:34.980 Q03fd3cc fromfile: Done with BLOCKEDSENDERS [2 lines
processed]

I had three lines, but only two cariage return line feeds. I think I've
fixed it:

12/05/2003 14:18:09.481 Q041f39c fromfile: Starting BLOCKEDSENDERS
12/05/2003 14:18:09.497 Q041f39c fromfile: Done with BLOCKEDSENDERS [3 lines
processed]

Thanks!

~Brad 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, December 05, 2003 10:47 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Help with 'fromfile'



> >And this in junkmail_blockedsendrs.cfg:
> >
> >sweet-n-sour.comdomain (@cooldude.sweet-n-sour.com) sends spam
> >
> >I do see BLOCKEDSENDERS firing for other things, but not for this. 
> >I'm assuming my error is in junkmail_blockedsenders.cfg, right? 
> >Should I change it to @cooldude.sweet-n-sour.com and just hope they 
> >don't send from other sub-domains?

In this case, it's time for the debug mode.  To use the debug mode, you can 
change the "LOGLEVEL LOW" line in \IMail\Declude\global.cfg to "LOGLEVEL 
DEBUG".  Then, after an E-mail gets through that should have failed the 
BLOCKEDSENDERS test, you can then switch back to "LOGLEVEL LOW" (the debug 
mode adds huge amounts of information to the log file).  You can then send 
me the \IMail\spool\dec.log file (as an attachment, NOT sent from web 
messaging), and I can take a look at it to see what is happening.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Help with 'fromfile'

2003-12-05 Thread T. Bradley Dean
v1.75

~Brad 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, December 04, 2003 5:55 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Help with 'fromfile'



>And this in junkmail_blockedsendrs.cfg:
>
>sweet-n-sour.comdomain (@cooldude.sweet-n-sour.com) sends spam
>
>I do see BLOCKEDSENDERS firing for other things, but not for this. I'm 
>assuming my error is in junkmail_blockedsenders.cfg, right? Should I 
>change it to @cooldude.sweet-n-sour.com and just hope they don't send 
>from other sub-domains?

What version of Declude are you running ("\IMail\Declude -diag" from a 
command prompt wil show you)?  I believe there was a version that had a 
problem if the return address was more than 32 characters long, which it is 
in this case.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] sniffer

2003-12-04 Thread T. Bradley Dean
>Declude is optimized to run the external test only once

That was going to be my next question, it looked terribly in-efficient at
first!

Thanks for the responses guys. I just installed the demo.

~Brad 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
Sent: Wednesday, December 03, 2003 8:10 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] sniffer


Brad,

That's right.
:-)

Heuristics for patterns are grouped by the spam that prompts us to generate 
them, or by how we created them. Most of the time they are at least close 
to classifying the type of spam. Each system that uses Message Sniffer is 
encouraged to specify adjustable weights for each rule group so that the 
results from the pattern matching tests can be "tuned" for the greatest 
accuracy on that system and according to it's unique mix of incoming spam 
and the users being served.

Declude is optimized to run the external test only once and allow the 
result code to be evaluated for all of the tests that define that external 
test... so in the example shown below sniffer would be called once and it's 
result code would be evaluated many times.

Message Sniffer will typically match many patterns in a given spam. 
Currently the voting system that decides the winning pattern match uses the 
following rule: Chose the first pattern match found with the lowest symbol.

Within the standard rulebase, rule groups are loosely grouped so that the 
least specific patterns have the largest symbols. The combination of these 
arrangements tends toward selecting the most specific pattern match 
available for a given message.

If anyone has other questions that are specific to sniffer then please feel 
free to contact us off list at our support@ sortmonster.com address.

Thanks,

_M

At 10:20 PM 12/3/2003, you wrote:
>Brad, Sniffer does message based pattern matching (Pete, correct me if 
>I am wrong).  If you opt to separate the 20 or so tests that Sniffer 
>currently supports, then you can set whatever weight you want to each 
>individual test. Here is how I currently have the individual Sniffer 
>tests defined in my global.cfg (License ID and Authentication Code 
>obscured):
>
>SNIFFER-WHITELIST external 000 
>"M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" -5 0
>SNIFFER-TRAVEL  external 047 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 07 0
>SNIFFER-INSURANCE external 048 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-AV-PUSH  external 049 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 07 0
>SNIFFER-WAREZ  external 050 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-SPAMWARE external 051 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-SNAKEOIL external 052 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-SCAMS  external 053 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-PORN  external 054 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 12 0
>SNIFFER-MALWARE  external 055 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 12 0
>SNIFFER-ADVERTISING external 056
"M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-SCHEMES  external 057 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-CREDIT  external 058 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-GAMBLING external 059 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 10 0
>SNIFFER-GREYMAIL external 060 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 07 0
>SNIFFER-OBFUSCATION external 061
"M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 12 0
>SNIFFER-SPAM  external 062 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 07 0
>SNIFFER-GENERAL  external 063 "M:\IMail\Declude\TPA\Sniffer\LicenseID.exe
>AuthenticationCode" 12 0
>
>You would need to adjust the weights to fit your own needs.  However, 
>this will at least give you a starting point.
>
>Bill
>
>- Original Message -
>From: "T. Bradley Dean" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Wednesday, December 03, 2003 6:43 PM
>Subject: RE: [Declude.JunkMail] sniffer
>
>
>How does Sniffer work?
>
>Their web page says:
>
>"In the best implementations allow you to assign a weight to each 
>possible result code. Declude, mxGuard, and SpamAssassin are all good 
>examples of syst

[Declude.JunkMail] Help with 'fromfile'

2003-12-04 Thread T. Bradley Dean
I got an email with this in the headers:

X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 210.17.164.118
with no reverse DNS entry.
X-Declude-Sender: [EMAIL PROTECTED]
[210.17.164.118]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: NOLEGITCONTENT, REVDNS
X-Spam-Weight: 1

I have this in GLOBAL.CFG:

BLOCKEDSENDERS  fromfileD:\iMail\Declude\junkmail_blockedsenders.cfg
x   5   0

This in $default$.junkmail:

BLOCKEDSENDERS  WARN

And this in junkmail_blockedsendrs.cfg:

sweet-n-sour.comdomain (@cooldude.sweet-n-sour.com) sends spam

I do see BLOCKEDSENDERS firing for other things, but not for this. I'm
assuming my error is in junkmail_blockedsenders.cfg, right? Should I change
it to @cooldude.sweet-n-sour.com and just hope they don't send from other
sub-domains?

Thanks,

~Brad

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] sniffer

2003-12-03 Thread T. Bradley Dean
How does Sniffer work?

Their web page says:

"In the best implementations allow you to assign a weight to each possible
result code. Declude, mxGuard, and SpamAssassin are all good examples of
systems that allow weights to be assigned to the result codes from Message
Sniffer."

So if Sniffer says an email is porn spam then it gets a weight of 10, but if
it's web hosting spam then it's 8? Does the weight differ depending on how
confident Sniffer is?

What do these rules look like in Global.cfg on $Default$.junkmail?

~Brad 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith
Sent: Tuesday, December 02, 2003 7:54 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] sniffer


Sniffer's well worth the $300.00 per year.
That breaks down to less than $1.00 per day.

It catches content that some RBLs don't catch.

Mark

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Keith 
> Anderson
> Sent: Tuesday, December 02, 2003 10:28 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] sniffer
>
>
> It's not worth paying the subscription fee, in my opinion.  I have a 
> client that's paying for it, and it doesn't catch very much that isn't 
> already caught somewhere else.
>
> > I am considering Maps too. But it's $1500/yr. Anyone using them?
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Why was this message delivered?

2003-11-26 Thread T. Bradley Dean
>Is the E-mail to that account forwarded to another account
>(in which case the MAILBOX action would not apply)?

I didn't even think of that, yes it is. Why does the MAILBOX action not
apply?

>Is it always happening for the same user(s), or just randomly?

So far it's just me and one other user seeing it - but most users wouldn't
know how to look for it.

The other user has two accounts, User.Office and User.Home. The User.Office
account is the main account and forwards like this: ".,
[EMAIL PROTECTED]". A spam came in with a score of 32 address to
User.Office. It was sent to the Spam mailbox of User.Office but delivered to
the inbox of User.Home.

What is Declude doing is this case?

>That's because the default action, if no action is defined, is IGNORE.

Ah, that makes a lot of sense. Thanks!

~Brad 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, November 26, 2003 4:40 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Why was this message delivered?



>A message was delivered with a weight of 38. The logs show this:
>
>11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches 
>or exceeds the limit of 10.). Action=WARN. 11/25/2003 01:09:06 Q1c273da 
>Msg failed WEIGHT15 (Weight of 38 reaches or exceeds the limit of 15.). 
>Action=MAILBOX. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT20 
>(Weight of 38 reaches or exceeds the limit of 20.). Action=IGNORE.

This E-mail should have been moved to the recipient's Spam mailbox.

Is the E-mail to that account forwarded to another account (in which case 
the MAILBOX action would not apply)?

Is it always happening for the same user(s), or just randomly?

>Why was the WEIGHT20 IGNORE rule followed, even when it had the # 
>comment marker before it?

That's because the default action, if no action is defined, is IGNORE.  So 
if you had had "#WEIGHT20 HOLD", you would still have seen "Action=IGNORE".
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Why was this message delivered?

2003-11-26 Thread T. Bradley Dean
JunkMail Pro (demo), iMail 7.04.

Almost all other mail is being delivered to the mailboxes, it just one or
two that we've spotted so far that have been delivered with more then 15
weight.

I don't think it was white listed, the headers / logs don't say anything
about that. And I haven't manually white listed anything yet. The only thing
that gets white listed is users' iMail address books, and this definitely
wouldn't be the case here.

~Brad 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Tuesday, November 25, 2003 10:23 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Why was this message delivered?


What version of JunkMail (Pro or Standard) and what version of Imail?

MAILBOX is only available in JunkMail Pro.

Could that message have been White Listed?

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> [EMAIL PROTECTED] On Behalf Of T. Bradley Dean
> Sent: Tuesday, November 25, 2003 6:50 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Why was this message delivered?
> 
> A message was delivered with a weight of 38. The logs show this:
> 
> 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches 
> or exceeds the limit of 10.). Action=WARN. 11/25/2003 01:09:06 
> Q1c273da Msg failed WEIGHT15 (Weight of 38 reaches or exceeds the 
> limit of 15.). Action=MAILBOX. 11/25/2003 01:09:06 Q1c273da Msg failed 
> WEIGHT20 (Weight of 38 reaches or exceeds the limit of 20.). 
> Action=IGNORE.
> 
> $default$.junkmail shows this:
> WEIGHT10  WARN
> WEIGHT15  MAILBOX Spam
> #WEIGHT20 IGNORE
> WEIGHT40  DELETE
> 
> Why was the WEIGHT20 IGNORE rule followed, even when it had the # 
> comment marker before it?
> 
> ~Brad
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Why was this message delivered?

2003-11-25 Thread T. Bradley Dean
A message was delivered with a weight of 38. The logs show this:

11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches or
exceeds the limit of 10.). Action=WARN.
11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT15 (Weight of 38 reaches or
exceeds the limit of 15.). Action=MAILBOX.
11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT20 (Weight of 38 reaches or
exceeds the limit of 20.). Action=IGNORE.

$default$.junkmail shows this:
WEIGHT10WARN
WEIGHT15MAILBOX Spam
#WEIGHT20   IGNORE
WEIGHT40DELETE

Why was the WEIGHT20 IGNORE rule followed, even when it had the # comment
marker before it?

~Brad 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] EASYNET tests going away December 1

2003-11-21 Thread T. Bradley Dean
>Bummer.  So we need to take those out of our global.cfg.

Yes, but what to replace them with? I'm running the defaults at this point
(DSBL, ORDB, SPACOP, BLITZEDALL, SBL). Scott, what will replace the EASYNETs
in the new install .CFG?

~Brad 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] How good does it get?

2003-11-20 Thread T. Bradley Dean
Thanks guys, that all helps. I took the plunge and changed the settings from
'test mode' to 'effect everybody' mode! Now hopefully management will like
it enough to buy it after 30 days. Maybe after 25 days I'll turn it off just
to remind 'em...

~Brad 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent: Thursday, November 20, 2003 2:42 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] How good does it get?


 Glenn:

What we do is simply a negative weight for newsletters. We review the
weights of 20-60 and delete on 60.

Newsletters typically fall between 20-40 range and if we find them we simply
add them to our negative email list or for the legitimate ones like Cato or
other organizations we simply whitelist their REVDNS.

Regards,
Kami




From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Glenn \ WCNet
Sent: Thursday, November 20, 2003 4:53 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] How good does it get?


Running JunkMail since May 2002.  I've done a bit of tuning on test weights,
am using Sniffer and several filters, contra-filter, and blacklist of my own
based on false-positives that I find on my own accounts, but I haven't done
near the amount of tuning that some have done.  I delete on weight20.  I
can't actively track misses and false-positives for all users because of the
sheer volume, over 1.5 million messages pass through here each week.  My
.dec logs (on level high) are generally 1 GB in size per day.  Running
DLAnalyzer reports that average 89% of total mail volume is deleted per day,
with about 1.5% delivered tagged as "possible spam" (weight14 to 19)  I have
had a couple complaints in recent weeks of users not getting newletters and
other "fringe" material.  In those cases I do a temporary whitelisting on
their account then do a contra-filter to reduce the weight on the msgs in
question.

It's a sad situation, really.  If I didn't have some way to get rid of the
spam, it would sap up huge amounts of drive space and many users would
simply give up on the battle and abandon their mail accounts.

Glenn Z.

- Original Message - 
From: T. Bradley Dean 
To: [EMAIL PROTECTED] 
Sent: Thursday, November 20, 2003 3:07 PM
Subject: [Declude.JunkMail] How good does it get?


I just installed the demo (Tuesday I believe) and I have it set to warn
only. My plan is to move everything with a weight of 20 or above to a 'spam'
folder in each users webmail. I may be able to do 15, so far the highest
legitimate mail we've seen was 14.

Looking at what's coming in, I'm getting about 80% of all spam. Another user
I have watching the headers (Outlook rule) is getting about 40%.

I'm going to go through the manual and see how smoothly I can get this
running, but of course management wants 100% of spam captured with no
legitimate mail blocked. How close can I expect to get? What levels of spam
are you guys capturing and what levels of legitimate mail is being blocked?

Any tips on what default settings I should mess with first? Any good threads
in the archives that I should read through?

Thanks in advance,

~Brad 

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] How good does it get?

2003-11-20 Thread T. Bradley Dean
I just installed the demo (Tuesday I believe) and I have it set to warn
only. My plan is to move everything with a weight of 20 or above to a 'spam'
folder in each users webmail. I may be able to do 15, so far the highest
legitimate mail we've seen was 14.

Looking at what's coming in, I'm getting about 80% of all spam. Another user
I have watching the headers (Outlook rule) is getting about 40%.

I'm going to go through the manual and see how smoothly I can get this
running, but of course management wants 100% of spam captured with no
legitimate mail blocked. How close can I expect to get? What levels of spam
are you guys capturing and what levels of legitimate mail is being blocked?

Any tips on what default settings I should mess with first? Any good threads
in the archives that I should read through?

Thanks in advance,

~Brad 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.