Mail Filtering Best Practices

[alvin at maggie.linux-consulting.com]

hi ya

On Thu, 20 Feb 2003, Danny Howard wrote:

> Over the years, I've come up with this general algorithm:

my basic rules...  they are considered spam if...
	- they have a host/domain that does not reolve ( reverse dns )
	- their messgage id is faked
	- coming from a non-existent user
	- addressed to non-existing users on my end
	- subject line has "whacky disallowed phrasess"
	- specific domains and ip# are unconditionally disallowed
	- few more tidbits

- i dont get many/any "false positives" .. i do NOT want to read 
  the spam twice.... nor do i want to save their spam locally
	- price for that is i do get a few that gets thru
	and i promptly add them to the "disallowed list"

( and yup .. i use sendmail + check-local .. sorry ..am a dinosaur )

	http://www.Linux-Sec.net/Mail/AntiSpam

c ya
alvin

> 1) Check with Spam software.  If Spam, file in "Spam".
> 2) Check against headers added by various list managers, file in list
>    folders.
> 3) If mail is addressed TO me in the headers, it goes in Inbox.
> 4) Anything left over goes to Inbox or Spam, depending on the efficacy
>    of step 1. :)
> 
> Duplicate-ID supression works in this scheme as well, anywhere before
> step 2.  I'm thinking this might be a fun article, so I'm keeping this
> on baylisa to solicit feedback.
> 
> -danny