Just to clarify, the division is related to circumstance and experiences rather than what is best globally. There is no global answer that is the best answer in every circumstance. I use IS because it is more conservative and I have already seen about 4 such violators in the last year (maybe more that didn't cause problems). This is directly related to my customer base, and others, especially the largest providers due to diversity, will have likely seen some of the same. You might not have these issues, or maybe your value system and tolerance for exceptions is different. You said that you score at only about 35% of your fail weight with this test, and that also allows greater leeway in picking up FP's.
Even some of the filters that I have shared contain more conservative settings that I personally use, and for the same reason. I would rather have someone modify the filter to be more strict than have to figure it out perfectly and look for how to loosen it or provide additional counterbalances. It's kind of a best overall approach, but not the single best approach. Still though, I'm sure my methodologies could improve. I learn something new every day.
Matt
John Tolmachoff (Lists) wrote:
It appears there is a division, those that fee CONTAINS or ENDSWITH should be used, and those that fee IS should be used.
I am going to try using ENDSWITH while subtracting weight for my backup MX.
I do not whitelist that IP, as Scott has before recommended not doing that, and I agree. Rather, I use IPBYPASS and the HOP settings. But that does not effect the HELO anyways.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
