<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I 2<sup>nd</sup> that! Very few false positives with Barracuda in my experience.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>You can also look at what IS being scored in SA on these spams and perhaps increase the score for some of the items. My personal opinion is that the default SA score is too low for quite a few of the rules.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Razor, Pyzor and DCC? They are a must IMO. It truly is a balancing act and you are NEVER going to stop all spam from getting through, but you can catch the vast majority of it with some diligence.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I am personally a proponent of using geoip blocking with xtables addon for iptables and blocking all of the major offending countries that I never have legit email from. I do understand for the global corporate scenario that is largely not possible to do.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Tracy Greggs<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] <b>On Behalf Of </b>Terry Hulen Jr<br><b>Sent:</b> Friday, November 08, 2013 10:34 AM<br><b>To:</b> MailScanner discussion<br><b>Subject:</b> Re: spam-<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal style='margin-bottom:12.0pt'>The first thing I would do is use your MTA to use the most common BL sites. If you follow this link you will notice that the first IP that you sent is listed on many BL databases:<br><br><a href="http://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a178.76.217.156&run=toolpage" target="_blank">http://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a178.76.217.156&run=toolpage</a><o:p></o:p></p></div><p class=MsoNormal>I would at least use Barracuda's BL database to block these at the MTA.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Fri, Nov 8, 2013 at 11:18 AM, Mark Sapiro <<a href="mailto:mark@msapiro.net" target="_blank">mark@msapiro.net</a>> wrote:<o:p></o:p></p><div><p class=MsoNormal style='margin-bottom:12.0pt'>On 11/08/2013 07:39 AM, Ejaz wrote:<br>> In my Mailscanner.conf the default score was set to 6, now I have<br>> reduced to 5. But fears is that some false positive can happen.<br><br><o:p></o:p></p></div><p class=MsoNormal>Spam detection is not an exact science. There will always be false<br>positives, false negatives or both.<br><br>Make sure your SpamAssassin rules are up to date and maybe try adding<br>some additional rules.<br><br>See <<a href="http://www.mailscanner.info/gettingthebest.html" target="_blank">http://www.mailscanner.info/gettingthebest.html</a>><br><span style='color:#888888'><br><span class=hoenzb>--</span><br><span class=hoenzb>Mark Sapiro <<a href="mailto:mark@msapiro.net">mark@msapiro.net</a>> The highway is for gamblers,</span><br><span class=hoenzb>San Francisco Bay Area, California better use your sense - B. Dylan</span></span><o:p></o:p></p><div><p class=MsoNormal style='margin-bottom:12.0pt'>--<br>MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!<o:p></o:p></p></div><div><div><p class=MsoNormal style='margin-bottom:12.0pt'>--<br>This message has been scanned for viruses and<br>dangerous content by MailScanner, and is<br>believed to be clean.<o:p></o:p></p></div></div></div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal><br>-- <br>This message has been scanned for viruses and <br>dangerous content by <a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is <br>believed to be clean. <o:p></o:p></p></div><br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.
</body></html>