Amazing amount of SPAM getting through

[Samuel Luxford-Watts]

You need SA.

You should see your detection rates rise a if you install SA. I found this
out whilst testing MS a little while back. We went 'Live' with MS/SA a
couple of weeks back and its been working very well indeed. I havnt really
'tuned' my configs for SA or MS spam yet but in its basic form it seems to
be marking about 75-80% of all spam. Some spam still gets through, but
looking at the logs its being scored just under the threshold so I need to
sit down and tune the SA rules I guess!

Sam

-----Original Message-----
From: Collins, Kevin [mailto:KCollins at NESBITTENGINEERING.COM]
Sent: 20 August 2003 13:06
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Amazing amount of SPAM getting through


Last night I set our MailScanner machine to handle 100% of our e-mail
traffic.  It immediately began sifting through our e-mails.  I was surprised
by three things:

1).  We get much more e-mail than I expected - about 600 a day from the
looks of it. 2).  That Sobig.F is moving so quickly - MailScanner caught 44
different e-mails with it yesterday evening. (YAY MailScanner!) 3).  Out of
the 600 or so e-mails, only 10 or so have been flagged as "Spam".

I can confirm No. 3 with a simple example - my mailbox.  When I arrived this
morning, I had 10 e-mails waiting on me.  Of those 10, 9 were SPAM.
MailScanner had only flagged (modified the Subject line with "{Spam}") 2 of
them.  If this dispersal is "typical" (which I doubt) that means that
approximately 78% of the SPAM we get is getting through MailScanner.

Don't get me wrong, I'm happy to be able to handle the 22% we are getting,
but this is nothing like the 95% claim that I've seen touted about.

I truly believe this is because of my configuration.  I'm using the stock
DNSBLs and rulesets that come with MailScanner 4.22-5.  I have been to
http://www.declude.com/JunkMail/Support/ip4r.htm and looked at additional
DNSBLs to add, but not sure which of those would be the best.  Any
suggestions?

Another question I have concerns SpamAssassin (SA).  Would my SPAM detection
rates go up if I include SA to the mix?  Do I need SA to get the 95% rate?

--
Kevin L. Collins, MCSE
Systems Manager
Nesbitt Engineering, Inc.

--------------
Winckworth Sherwood Solicitors and Parliamentary Agents
DX 148400 WESTMINSTER 5 : 35 Great Peter Street, London SW1P 3LR
Telephone 020 7593 5000 Fax 020 7593 5099

Do something amazing!
The firm is supporting a charitable bike ride through Vietnam and needs your help. For further information please visit http://www.vietnambikeride.org

-Confidentiality-
This email message and any attachments are confidential; they may be subject to legal professional privilege and are intended for the named recipient only. If you are not the named recipient, please return the message and enclosures immediately and delete them from your system.

-Caution-
Before advice received only by email (whether by attachment or otherwise) may be relied on, the authenticity of the communication must be verified by means independent of email.

-Regulation-
The firm is regulated by the Law Society.

-Partners-
A list of partners is available for inspection at each office of the firm and on the firm's website at http://www.winckworths.co.uk