Ignore Spam Whitelist If Recipients Exceed....

[Sylvain Phaneuf]

Hi everyone,

This is my annual message to the list. Mailscanner is too d*** good, I
don't can't find anything that goes wrong...

We have come across a few messages lately that were flagged as spam
while the sender was on our whitelist. I wonder what is the current
wisdom on this... here it goes:

we have kept the default setting for:
Ignore Spam Whitelist If Recipients Exceed = 20

This morning someone we trust (!???) forwarded a message to 45 people -
she had received that message from someone she trusts (!!??!). It turns
out that the original message triggered two SA rules (MSGID_DOLLARS =
Message-Id has pattern used in spam  and MSGID_OUTLOOK_INVALID =
Message-Id is fake (in Outlook Express format)). Other than that the
message was cleaned and we feel we should have let it go without
flagging it as spam. We are very careful to what we had to our
whitelist.

Should we raise our "Ignore Spam Whitelist If Recipients Exceed" to a
bigger number? What do people do out there?

Looking forward to reading your suggestions all.

Thanks again to all the regular, and to Julian!

Sylvain




-- 

============================================
Sylvain Phaneuf --- Systems Manager | phone : +44 (0)1865 221323
Information Management Services Unit - Medical Sciences Division 
Oxford University | email : sylvain.phaneuf at imsu.ox.ac.uk 
Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322
Oxford, OX3 9DU,   UK
============================================