Re: [vps-mail] Feedback requested - filter on [hormel luncheon meat] in subject?

["Andy McKell, FOCUS Internet" <mac@xxxxxxxx>]

At 09:23 PM 12/6/2005 -0800, you wrote:

> At 6:20 AM +0100 12/7/05, Andy McKell, FOCUS Internet said something about:
> > When I reached 300 spams a day, I introduced a spam/virus filtering which 
> > labels everything suspect as {spam} in my subject line before delivery to 
> > my own server. Anything with spam in the subject line (not on my client 
> > whitelist) gets trashed by procmailrc. Last count this was 800 a day.
> >
> > Anyone not on my whitelist sending me a business email which seriously 
> > looks like spam gets lost - but do I need such a customer?
>
> I understand what you're saying, but is your whitelist in SA or in Procmail?
>  If in SA, then a procmail that filters based on {spam} will knock out 
> folks who are on your SA whitelist, correct?

Maybe I mislead you with my cut-down summary.

When I set the spam/virus filtering system up (SA and MailScanner 
filtering), I offered it to my clients (at a small fee) and all my 
contributing clients' mails are run through that server, so we use a 
standard set of initial criteria. Mail from known databased spammers (e.g. 
from Spammers-R-Us.ru) is bounced. ALL other mails are delivered to the 
appropriate server, where a plethora of individual preferences are catered 
for by Procmail recipes. Some folks want to see the suspect spam, others 
join me in trashing the lot, some want specific addresses blacklisted, some 
want to receive .exe attachments (!) others don't....

We actually use the strings:-

{Spam?}
{Virus?} (but the suspect material is extracted and quarantined first)
etc...

for our own insertions at the START of the Subject line. For me, Procmail 
dumps mails with those texts in that exact position:-
* ^Subject: {SPAM?}
Hence, any emails labelled so but forwarded by a client don't get trashed.

Also, anything labelled specifically {spam} or [ADV] or similar codes 
generously supplied by the sender and addressed to MY domain(s) gets 
trashed by Procmail.

However, I have my own whitelist in .procmailrc so SA and MailScanner codes 
are ignored. at the trashing stage. (I do have one client whose emails 
trigger spam filters but who just likes sending mails which look like Xmas 
cards)

We DO have whitelists in SA/MailScanner for general, known "issues" - such 
as subscription mailing lists or attachments from companies using online 
ordering where valid documents (e.g. airline ticket vouchers) are attached 
but which trigger MailScanner quarantining.

All mail arriving without the filtering server's domain in the routing gets 
trashed as it is an mx20 or other backdoor attempt and so is - by 
definition - self-nominating as totally unwanted. (But don't forget to 
whitelist all domains on the recipient server as these "local" mails stay 
on the server and would not pass through the external filter. A residual 
issue is viruses sent in such a "local" manner, but we're working on that)

New sub-hosting clients will not get the option to use iManager filters, to 
avoid the build-up of unexamined Junk mailboxes.

I hope this helps clarify?

Andy

> > At 09:04 PM 12/6/2005 -0800, you wrote:
> >
> > > I'm getting spam that is sent out and has [spam] in the subject line. I 
> > > know that there were some state laws that specified spam had to be 
> > > labeled as such, but since those were all stricken when (now you) 
> > > CAN-SPAM was enacted, I'm not sure what the deal with these are.
> > >
> > > Normally I'd add a rule to SA to add 50 points to a [spam] labeled 
> > > email, but i've seen it happen where my email was labeled as spam by a 
> > > recipient's server, and that put a [spam] in the subject line, and then 
> > > they responded to my (tagged) email.  Had I enacted that +50 point rule, 
> > > I'd never have gotten that email.
> > >
> > > So my question: Do any of you have filters that filter out [spam] in the 
> > > subject line (i've not used it here just incase someone does)?  I don't 
> > > get too much spam that way - maybe 4-8 a day, but if it starts getting 
> > > bad, this could be a problem...
> > >
> > > Thanks,
> > > Matt
> > > --
> > > :-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+
> > > Matthew I. Cohen                                   http://www.iwbyte.com/
> > > It Won't Byte Web Design & Hosting.     Ob. Quote: "Reality is for those
> > > email: lists@xxxxxxxxxx                  people who can't handle Fantasy"
> > > ======================================================================
> > > This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
> > > Before posting a question, please search the archives (see above URL).
> >
> > --------------------------------------------------------------------
> > FOCUS Internet Services
> > Domains, Design, Hosting, Custom Applications, E-Commerce, 
> > Anti-spam/virus Solutions
> > 106 rue de Mersch, L-8181 KOPSTAL, Luxembourg
> > tel. (+352) 305 197
> > fax (+352) 305 188
> > Skype : mckell-focus
> > www.focus.lu 
> > ======================================================================
> > This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
> > Before posting a question, please search the archives (see above URL).
>
> --
> :-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+
> Matthew I. Cohen                                   http://www.iwbyte.com/
> It Won't Byte Web Design & Hosting.     Ob. Quote: "Reality is for those
> email: lists@xxxxxxxxxx                  people who can't handle Fantasy"
> ======================================================================
> This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
> Before posting a question, please search the archives (see above URL).

--------------------------------------------------------------------
FOCUS Internet Services
Domains, Design, Hosting, Custom Applications, E-Commerce, Anti-spam/virus 
Solutions
106 rue de Mersch, L-8181 KOPSTAL, Luxembourg
tel. (+352) 305 197
fax (+352) 305 188
Skype : mckell-focus
www.focus.lu  

======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).