Spamscreen - Rules list

[lizzieborden]

Is anyone out there using spamscreen? If so, are you using the rules list to filter out emails based on criteria? In the past I've added rules and they worked. Lately though I add rules and they are not working???? Also, is there any documentation on how to setup the rules and what all of the switches mean? I did get a spamscreen book with my firewall but it just states how good the product is.

 

[RockChalk]

We just started up our spamscreen. It was working and this morning it stopped. They had me check my DNS settings and change to 4.2.2.2 and then it started working again

RC

 

[lizzieborden]

My spamscreen is working. That is all but the new rules that I've tried to create in the past week. The rules I've created in the past work. I'm a little confused as to what switches to use and when. Also don't know what to use for spam weight.

If anyone could point me in the right direction I'd really appreciate it...

 

[RockChalk]

Here is a website that will help you create rules and test them.

https://www.mynetworktools.com/spamtools.html

Try it out and let me now what you think.

 

[RockChalk]

Did the tools help you?
RC

 

[lizzieborden]

RC -

Love the tools but how do I know what to use for a spam weight??

 

[RockChalk]

What is your threshold weight set at?
RC

 

[RockChalk]

I set ours up so that if someone is on a RBL list and one of the rules apply the email gets block.
If I setup a rule that I know for sure that only thing that it will block is Spam then I set the rule weight over the threshold.
Example: I setup a special rule that blocks any email the is from real-coupons. I set the wieght over the threshold because I know it is spam.

Hope this helps. It's woring for me.

 

[lizzieborden]

Okay thanks. The tool is a little confusing. Maybe I'm just confused... When I go to test the rule it asks me for a rule and a string?????

Oh yeh, my threshold weight is 1999.

Also, do you know how to stop the entire email containing the denied .txt file from reaching the users mailbox. The questions concerning these .txt files are starting to overwhelm me as everyone thinks the .txt file is a virus.

 

[RockChalk]

I created a new rule that looks for word junk in the from so to test it:
Rule : ^((?i)From):\s(?i).*purchase
String : From: Mystery Classics [ADV@4EPURCHASE.COM]
and GO. It tells you if the spam will get caught or not.

Does the txt file start with ATT#####.txt?
RC

 

[lizzieborden]

RC -

Thanks!! I did create a few rules and imported them...

Yes, the .txt file starts with ATT*****.txt. I know that is the message from the firewall. I do not want my users to get the whole email containing that file. I want to somehow discard the whole email without the user ever seeing it...

Thanks Again!!

 

[RockChalk]

I believe those are attachments that you aren't allowing thru right?
I haven't found a way to stop the users from getting them.
I'll check into it.

Anyway
Oh by the way that rule was looking for the word purchase not junk.

 

[RockChalk]

You can't stop them.
Sorry
RC

 

[lizzieborden]

Thanks for all of your help. It has been valuable. I'll let you know if I find anything reguarding deleting the files before they get to the user...

 

[msuski]

RC: What if I want to screen out all the "Magic"-type senders. Your example of June 23 shows how to screen out anything with "purchase", but I want to get rid of all the "Health" emails.