<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>RE: Effort to manage MailScanner</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>I have faced similar situations regarding false positives. One method that I found useful was to DELETE high scoring spam and DELIVER normal spam. Using this model you can set your spam score more aggressively because users still receive the mail with a {Spam?} or similar markup in the subject line. High scoring spam (which you can keep at a high score) is rarely a false positive but I usually opt to forward to a review account to keep an eye on it. </FONT></P>
<P><FONT SIZE=2>Once you have a configuration like this in place you would either want to instruct your help desk to show users how to setup a mail rule to drop subjects containing {spam?} into a spam review folder or distribute a document to your users with the procedure. </FONT></P>
<P><FONT SIZE=2>I found this method to allow me to catch more spam while lowering the risk of true false positives. Seeing all the {Spam?} messages also lets the user populace know that the filter is working (nice side effect). </FONT></P>
<P><FONT SIZE=2>Another process I like to use (with caution) is to setup a mailbox for spam issues that users can send mail to. Most of these messages turn out to be "please black list this message, it is spam" with an occasional "please white list this domain" or even a "thank you so much, I can now get through my inbox in less than 8 hours!" Once a week you can go through the messages, document your white list, black list and possibly rules modifications, fill out your change control form (you do practice proper change management, right?) and you're all set. This administrative mailbox is the main drive for my tweaking. </FONT></P>
<P><FONT SIZE=2>NOTE: I also do not upgrade unless there is a feature I need or want. </FONT>
</P>
<BR>
<P><FONT SIZE=2>> -----Original Message-----</FONT>
<BR><FONT SIZE=2>> From: Pete [<A HREF="mailto:pete@eatathome.com.au">mailto:pete@eatathome.com.au</A>] </FONT>
<BR><FONT SIZE=2>> Sent: Wednesday, December 10, 2003 4:36 PM</FONT>
<BR><FONT SIZE=2>> To: MAILSCANNER@JISCMAIL.AC.UK</FONT>
<BR><FONT SIZE=2>> Subject: Effort to manage MailScanner</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> Sorry i couldnt think of a better subject heading.</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> I have had MS running now for a full month and it appears to </FONT>
<BR><FONT SIZE=2>> be working perfectly - in our ORg we cannot be too agressive </FONT>
<BR><FONT SIZE=2>> as false positives would a lot of criticsm, so i have used </FONT>
<BR><FONT SIZE=2>> almost defaults settings, but we get no UCEs delivered to </FONT>
<BR><FONT SIZE=2>> staff or students and have had only one false positive so far.</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> We have 600-700 mail accounts but only recieve 1500 emails a </FONT>
<BR><FONT SIZE=2>> day %30 being spam.</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> I have noticed on these forums a lot of people spending a lot </FONT>
<BR><FONT SIZE=2>> of time changing settings, adding RBLs, upgrading every new </FONT>
<BR><FONT SIZE=2>> release or beta and i wanted to know what benifits these </FONT>
<BR><FONT SIZE=2>> folks recieves vs thier effort - its starting to make me feel </FONT>
<BR><FONT SIZE=2>> like i shouold be upgrading to latest too - except i dont </FONT>
<BR><FONT SIZE=2>> want to have my head buried in MS config every day for the </FONT>
<BR><FONT SIZE=2>> next month - i thought this and install, config and forget </FONT>
<BR><FONT SIZE=2>> type system, which is how i have been treating it (though i </FONT>
<BR><FONT SIZE=2>> check quarrantine daily at the momment), are you guys getting </FONT>
<BR><FONT SIZE=2>> some benifit that i am not, or is because you ahve far </FONT>
<BR><FONT SIZE=2>> greater volumes of mail that you get more spam through MS </FONT>
<BR><FONT SIZE=2>> aqnd have to work harder to stop it?</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> I suppose its my cautious, no downtime nature that keeps us a </FONT>
<BR><FONT SIZE=2>> few versions behind with alsmot all of my systems...</FONT>
<BR><FONT SIZE=2>> </FONT>
</P>
</BODY>
</HTML>