SPAM Survey - delete or filter?

So, with the various anti-spam solutions you all run, do you delete all the
SPAM on receipt and take your chances with false-positives, or do you filter
it into a folder (e.g. Junk Email) for your users to have a chance to dig
through before it gets deleted?

We do the latter, but with the volume constantly increasing it's becoming
impractical, so are considering doing the former.

Alexander
Fri Mar 14 12:32:38 CDT 2008


Here is what I recommend for IMF users.

Ideally you would use a mix of Rejection (not Delete) and moving to Junk.

Reject emails that are rated as spam with a high degree of certainty
(SCL8-9).
Move to Junk Email that are very likely to be spam(SCL 5-7).

--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"Phil McNeill" <philmcneill@REMOVETEXTINCAPShydroottawa.com> wrote in
message news:ucajsXfhIHA.4320@TK2MSFTNGP06.phx.gbl...
> So, with the various anti-spam solutions you all run, do you delete all
> the SPAM on receipt and take your chances with false-positives, or do you
> filter it into a folder (e.g. Junk Email) for your users to have a chance
> to dig through before it gets deleted?
>
> We do the latter, but with the volume constantly increasing it's becoming
> impractical, so are considering doing the former.
>

John
Fri Mar 14 12:49:08 CDT 2008

The problem I have with "filter only" solution is click happy users. They'd
click anything in their mailbox, junk or not.
I agree with Alexander's recommendation. Don't silently delete mail. With
"Reject" option, at least legitimate senders know their mail doesn't make
it.

"Phil McNeill" <philmcneill@REMOVETEXTINCAPShydroottawa.com> wrote in
message news:ucajsXfhIHA.4320@TK2MSFTNGP06.phx.gbl...
> So, with the various anti-spam solutions you all run, do you delete all
> the SPAM on receipt and take your chances with false-positives, or do you
> filter it into a folder (e.g. Junk Email) for your users to have a chance
> to dig through before it gets deleted?
>
> We do the latter, but with the volume constantly increasing it's becoming
> impractical, so are considering doing the former.
>

Cary
Fri Mar 14 15:55:42 CDT 2008

Phil,

What I used to do with EXCH2003 SP2 and EXCH2007 environments is to set the
'filter' to archive 7s and 8s and 9s and then use UCEArchive (if EXCH2003)
or managedquarantine (if EXCH2007....well, that was really only 7s as the 8s
and 9s were handled differently). This quickly became an administrative
nightmare. We have several clients who have more than 10,000 items in the
"archive" per month (and quite small number of users...20 - 70 is the
average number of users per client ).

Have fun going through that. I am sure that this plays a big role in why
you are asking.

Well, got tired of looking (99% of everything I looked at was absolutely
spam and the remaining 1% was 98% spam!).

I changed things after enduring these settings for a couple / three months
to what Alexander suggests (sorta). I reject the 7s and 8s and 9s while 5s
and 6s go to the Junk Mail folder in the user's mailbox. Now, every client
is different so the 7s can go either way. That is why I 'endured' for a few
months. There were really not that many 7s in the environments that I
manage so I can confidently reject them. That might be different where you
are.

And, it was a concious decision to reject them and not to delete them. If
it is rejected the the good guys will know why and can contact us.....Were
the other setting enabled (delete) then the good guys would never receive
that "your e-mail has been rejected because it looks like spam" message.

HTH,

Cary


"Phil McNeill" <philmcneill@REMOVETEXTINCAPShydroottawa.com> wrote in
message news:ucajsXfhIHA.4320@TK2MSFTNGP06.phx.gbl...
> So, with the various anti-spam solutions you all run, do you delete all
> the SPAM on receipt and take your chances with false-positives, or do you
> filter it into a folder (e.g. Junk Email) for your users to have a chance
> to dig through before it gets deleted?
>
> We do the latter, but with the volume constantly increasing it's becoming
> impractical, so are considering doing the former.
>

Phil
Mon Mar 17 10:16:32 CDT 2008

Thanks for the input gang. We're getting more and more call to "make this
SPAM go away" here, as the volumes increase daily it seems. We've done a
good job filtering it for people for several years, but with hundreds of
messages per user per day, they don't want to look through the filtered mail
anymore to find that rare gem. Gotta come up with a way to decrease the
total amount they're seeing.

Thanks again, and please lobby to bring back the death penalty, for spammers
only. ;)


"Phil McNeill" <philmcneill@REMOVETEXTINCAPShydroottawa.com> wrote in
message news:ucajsXfhIHA.4320@TK2MSFTNGP06.phx.gbl...
> So, with the various anti-spam solutions you all run, do you delete all
> the SPAM on receipt and take your chances with false-positives, or do you
> filter it into a folder (e.g. Junk Email) for your users to have a chance
> to dig through before it gets deleted?
>
> We do the latter, but with the volume constantly increasing it's becoming
> impractical, so are considering doing the former.
>

Rich
Mon Mar 17 20:59:06 CDT 2008 Deleted

Phil
Wed Mar 19 14:38:39 CDT 2008 Deleted

Susan
Wed Mar 19 14:56:16 CDT 2008 Deleted

Jamer1
Wed Mar 19 15:08:16 CDT 2008

Some products are out there to archive email that comes through your
system. We use EMC Email Xtender (formerly Legato) and it does some
things well, but tends to have some annoying bugs. The one thing
having it allows us to do is keep spam for about three months in an
archive (one weeks worth goes into a spam catching mailbox)...i don't
want to keep anymore than that. If people are looking for something
that might be a false positive, they've got three to four months to go
look for it via the Email Xtender search...which allows users to
search both the regular archive indexes as well as a separate spam
index we set up to collect our tagged spam. So the legato archive
helps us keep our spam mailbox down to a week's worth of junk and
allows users to look for spam up to 3 to 4 months back...depending on
when I purge the spam index.

Hard to believe when I started doing this a couple years back we
received maybe 25K emails every two weeks... We're up to almost 500K
a week! I have to use keyword checking filters ahead of whitelists
so, it's fairly tuned and fairly aggressive.