odd spam catching results between 2 mail scanners.

[Kevin Spicer]

On Tue, 2003-11-04 at 00:27, Lance Ware wrote:

>One mailscanner shows a spam percentage of 62.49% and the other only
>42.83%.

>Both boxes are set to 10 in terms of MX preference.

>Any thoughts???

Maybe your DNS servers always return them in the same order and some of
the spam tools just pick the last or second on the list?

Do they send out 50/50, or do certain senders send through certain
machines.  I think some spammers/ viruses can pick up the email server
from headers of messages rather than DNS (you tend to see this with
dictionary attacks, I get countless messages addressed to 'users' @
mymailserver, despite the fact that I have no users with addresses of
that form)

>Is there any easy way to verify that SA is using the same sets of
>network based tests between boxes?

Get some sample mails and run them through spamassassin -D -t  on each
machine and diff the results


TIA,



Lance











BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.