Forwarded mail lets spam through

[Matt Bullock]

Thanks, I have been advised before to take bigevil out, so I guess I
should try that route now.  

Right now SA is catching about 98% of the spam received, it just doesn't
tag anything that is forwarded from one particular server.


Regards,

Matt Bullock
Troika Networks, Inc.
Network Administrator
805.367.2728

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
Behalf Of Martin Hepworth
Sent: Wednesday, September 08, 2004 8:01 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: Forwarded mail lets spam through

Matt

don't use bigevil.cf, its absolutely huge (go on look at the size:-)

do use the surbl.org an spamcop_uri plugin which uses the same
data..which you say you are using, so take out he bigevil rules..it's
duplicating work.

I'd also look at drip feeding in the SARE rules from
www.rulesemporium.com, one at time and see how that helps.


as your original question have you looked at creating a ruleset for

Spam Checks = %rules-dir%/spam.rules



which in my case doesn't scan email the come from my LAN.


you should be able to pop in a rule that doesn't scan from this
particular host.


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matt Bullock wrote:
> Thanks for the replies, Karanbir and Ugo.
>
> I am running SA with RBL's, URI's etc. and these others:
>
> 99_FVGT_Tripwire.cf  bigevil.cf                bogus-virus-warnings.cf
> random.current.cf  spamcop_uri.cf
> antidrug.cf          bigevil.cf.20040902-0008  evilnumbers.cf
>
>
> Regards,
>
> Matt Bullock
> Troika Networks, Inc.
> Network Administrator
> 805.367.2728
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On 
> Behalf Of Ugo Bellavance
> Sent: Wednesday, September 08, 2004 6:51 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Forwarded mail lets spam through
>
> Matt Bullock wrote:
>
>
>>I have an email address that is forwarded from another server to an 
>>email account that I host, and mail coming from this particular server
>
>
>>never triggers the spam filter.  Is there a way to have mailscanner 
>>drop a known server from the headers to allow the spam filter to work 
>>more accurately?
>
>
> What do you use for spam filtering?  That won't work if you only use 
> DNSBL.  Spamassassin should look at all the headers.
>
>
>>Regards,
>>
>>Matt Bullock
>>Network Administrator
>>Troika Networks, Inc.
>>805.367.2728
>>

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the
system manager.

This footnote confirms that this email message has been swept for the
presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).