Forwarded mail lets spam through

[Martin Hepworth]

<x-flowed>
Matt

oh sorry mis-read it.


there's how to add a domain to the ws.surbl.org list (via Bill Stearns
sa-blacklist.cf)...

http://www.stearns.org/sa-blacklist/README.submissions.html
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matt Bullock wrote:
> Thanks, I have been advised before to take bigevil out, so I guess I
> should try that route now.
>
> Right now SA is catching about 98% of the spam received, it just doesn't
> tag anything that is forwarded from one particular server.
>
>
> Regards,
>
> Matt Bullock
> Troika Networks, Inc.
> Network Administrator
> 805.367.2728
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of Martin Hepworth
> Sent: Wednesday, September 08, 2004 8:01 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Forwarded mail lets spam through
>
> Matt
>
> don't use bigevil.cf, its absolutely huge (go on look at the size:-)
>
> do use the surbl.org an spamcop_uri plugin which uses the same
> data..which you say you are using, so take out he bigevil rules..it's
> duplicating work.
>
> I'd also look at drip feeding in the SARE rules from
> www.rulesemporium.com, one at time and see how that helps.
>
>
> as your original question have you looked at creating a ruleset for
>
> Spam Checks = %rules-dir%/spam.rules
>
>
>
> which in my case doesn't scan email the come from my LAN.
>
>
> you should be able to pop in a rule that doesn't scan from this
> particular host.
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matt Bullock wrote:
>
>>Thanks for the replies, Karanbir and Ugo.
>>
>>I am running SA with RBL's, URI's etc. and these others:
>>
>>99_FVGT_Tripwire.cf  bigevil.cf                bogus-virus-warnings.cf
>>random.current.cf  spamcop_uri.cf
>>antidrug.cf          bigevil.cf.20040902-0008  evilnumbers.cf
>>
>>
>>Regards,
>>
>>Matt Bullock
>>Troika Networks, Inc.
>>Network Administrator
>>805.367.2728
>>
>>-----Original Message-----
>>From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
>>Behalf Of Ugo Bellavance
>>Sent: Wednesday, September 08, 2004 6:51 AM
>>To: MAILSCANNER at JISCMAIL.AC.UK
>>Subject: Re: Forwarded mail lets spam through
>>
>>Matt Bullock wrote:
>>
>>
>>
>>>I have an email address that is forwarded from another server to an
>>>email account that I host, and mail coming from this particular server
>>
>>
>>>never triggers the spam filter.  Is there a way to have mailscanner
>>>drop a known server from the headers to allow the spam filter to work
>>>more accurately?
>>
>>
>>What do you use for spam filtering?  That won't work if you only use
>>DNSBL.  Spamassassin should look at all the headers.
>>
>>
>>
>>>Regards,
>>>
>>>Matt Bullock
>>>Network Administrator
>>>Troika Networks, Inc.
>>>805.367.2728
>>>
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they are
> addressed. If you have received this email in error please notify the
> system manager.
>
> This footnote confirms that this email message has been swept for the
> presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>