MailScanner marks everything as spam

[Scott Silva]

on 3-25-2008 2:50 PM Gregory Wong spake the following:
> What do you recommend for blacklist lookups?
 >And how much blacklists does an email have to be on in order
 >for it to be considered spam? I ran into this problem with my mail scanner 
today.
> 
It depends on what you are going to do with the result.
If you are going to dump it, why not use the blacklist at the MTA where it 
cuts the system load?

If you are going to quarantine it or mark it as spam and send it on its merry 
way, and you are using spamassassin, use the spamassassin scoring system, 
adjusting what you need to get the ratio right.

If you are not using spamassassin, and just want to mark and forward (catch 
and release in fishing terms)or quarantine based on the blacklists, then 
MailScanner is the place to do it.

As for how many blacklists, that is also dependent on where you are using them.
If at the MTA, the first hit drops the message and you can use whichever lists 
don't FP for you.
If in spamassassin, the lookups are in parallel, so 1 lookup takes close to as 
long as 10 lookups do, so use as many as you want.

In MailScanner, each lookup is done one after the other, so the more lookups 
you do, the longer it takes to deliver mail. I wouldn't use more than 2 or 3 
here. (I wouldn't do any here personally, but that is my setup)


But the most important thing is to use a blacklist that is OK in your 
environment. A list that is highly effective for me might block your boss or 
your CEO, causing you to do unemployment lookups and job queries.  Not good!

I have been keeping track of the hits I get with spamassassin, and if I hit 
100% spam on a list for 3 to 4 months, I move it to the MTA. All others I 
leave in spamassassin and just let the scores accumulate.

And the last concept is this... If you accept the message, spam or not, don't 
bounce it. Only drop spam during the time that the original server is still 
connected to you. Anytime after that will get you on a blacklist, and we will 
all be blocking you!



-- 
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080325/425d3a6e/signature.bin