How to handle email caught by IMF

[scottew]

I was just curious how people handle the email that is caught by IMF. I currently have it set to Archive emails with a SCL rating higher than 6 at the Gateway and send messages to the Junk Email folder with a rating of 5 or higher.

It seems to be a full time job to review messages that are archived.

So do most people archive the messages or do you just delete them?

 

[MarkArnold]

The IMF is pretty reliable really. Whilst 5 might be a tadge stringent I'd just delete. What I might do is knock it up to 7 or 8 and then delete. If too much spam gets through you can knock it down a notch.
Are you using one of the free/share/cheap IMF Monitor tools or just perusing manually?

 

[DanMIS]

When I used IMF I used to archive the messages for a week or so, then delete. During that time I would quickly scan the messages using this:

http://www.thespidersparlor.com/downloads/imfspam.zip

I don't recall my settings, but I think I used 5 for the Junk folder, and 7 to block. You can adjust it as needed once you run it for a while. To me, blocking legitimate was worse than allowing SPAM.

I also set up a bunch of exclusions in IMF by editing the .xml file (don't recall the name) to ensure some mail always got delivered, for example mail between the Blackberry services.

A user markdmac deserves all the credit for the linked file.

Dan

CCA Citrix 4.0
MCSA: Messaging 2003
293 - passed

 

[scottew]

Thanks for the responses guys.

I have been using Mark's script to review the spam mail (thanks again for that Mark). I just get tired of reviewing all the junk. Over the past couple of months, I might have found 1 or 2 legitimate emails. I was just wondering how other people handled it. Whether they just set IMF to automatically delete the mail or if they reviewed it.

We are also using GFI Mail Essentials and Mail Security. The combination of both of these has drastically reduced our spam.

Thanks again,
Scott

 

[markdmac]

Glad you guys are finding my stuff useful.

Most of my customers allow their users to view the archive and grab their own legitimate emails by themselves. otherwise they use my CleanBadMail script to autodelete the email after whatever number of days they set in the script.

Another option is to just use the script above and only look int he archive if a user complains they have not received a message they are waiting for.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[jamba]

We delete any email which has a SCL of 7 or higher. We used to have IMF handle the deletion but we wanted to be able to log what emails had been received and deleted just in case a user needed to know so we changed the action to "No Action" and user Symantec's Mail Security to handle the deleting of the email. Our server is handling a bit more mail but we have an electronic trail to fall back on in case people need to know if the email made it to our server. The other advantage to using Symantec is we are able to add email addresses to the filter to allow emails from that address through the filter.

Andy