Fighting Spam while not creating false positives is much more involved than using e-mail addresses and keywords. On our e-mail server, we have 43 different tests that run on each message to determine the weight of the message, and then take appropriate action based on that weight. These tests include IP based, (tests based on the sending mail server,) filters, (keywords and addresses, both white and black,) pattern matching and the formatting of the message itself including headers. Using this balanced weighted approach, of the aprox. 3500 messages per day processed, we have no false positives automatically deleted, 95% spam stopped from reaching the users mail box as reported by end users, and only about 50-75 messages per day held for manual human review. On example is messages formatted with MS Outlook Vulnerabilities. Some of these will actually caused a message not to be scanned by a normal spam filter. The software we use is design to catch these as part of the message formatting checks. So, although we would all like to see one device provide all the "protection" we want, a balanced multi layer approach is the best way. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -----Original Message----- From: Terzano, Thierry [mailto:Thierry.Terzano@xxxxxxxxxxxxxxxx] Sent: Tuesday, February 11, 2003 3:27 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: spam http://www.ISAserver.org Hi, You can use your Mail Server configuration for that at first step... For example, you tell it to block all messages from specified addresses. That's what I do with Exchange 2000. Hoping it helps... Thierry -----Original Message----- From: Mario Videira [mailto:videira@xxxxxx] Sent: Tuesday, 11 February 2003 13:08 To: [ISAserver.org Discussion List] Subject: [isalist] spam http://www.ISAserver.org Hi all, Sorry my english, so i want to know how can stop spam using Isa Server? Any idea? Best Regards Mario Videira ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Exchange Server Resource Site: http://www.msexchange.org/ Windows Security Resource Site: http://www.windowsecurity.com/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: thierry.terzano@xxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Exchange Server Resource Site: http://www.msexchange.org/ Windows Security Resource Site: http://www.windowsecurity.com/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: isalist@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')