Re: Exclude from RCVD_IN_DNSWL_MED

2012-09-17 Thread Noel Butler
On Mon, 2012-09-17 at 10:52 -0400, Kris Deugau wrote: > I see more spam[1] from any one of Hotmail, Yahoo, or GMail than I do > coming through the whole set of email service providers I've IDed > (both email-hosting and bulkmailers) of all stripes. > > As an ISP mail admin, I **CANNOT** afford t

Re: Exclude from RCVD_IN_DNSWL_MED

2012-09-17 Thread Noel Butler
On Mon, 2012-09-17 at 10:44 -0400, dar...@chaosreigns.com wrote: > On 09/17, Noel Butler wrote: > >I'm sure every network running a mail server would like to assume they > > are > >100% whitehat too. I see no reason to treat them special, just like gmail > >who think they are above it

Optimizing scoring Re: Exclude from RCVD_IN_DNSWL_MED

2012-09-17 Thread darxus
On 09/17, Kris Deugau wrote: > As an ISP mail admin, I **CANNOT** afford to block legitimate mail > from any source, and if I see a report that a legitimate mail was > blocked by any local rules or DNSBL data, I change the local rule or > delete the offending local DNSBL entry ASAP. Some times I e

Re: Exclude from RCVD_IN_DNSWL_MED

2012-09-17 Thread Kris Deugau
Noel Butler wrote: > It is the exact same approach we all take and should take to all > spammers, if mail.foobar.com was hitting you with shitloads of > spam from someuser.example.com, someotheruser.example.net and so > on, you take out mail.foobar.com, because THEY are the mongrels > that con

Re: Exclude from RCVD_IN_DNSWL_MED

2012-09-17 Thread darxus
On 09/17, Noel Butler wrote: >I'm sure every network running a mail server would like to assume they are >100% whitehat too. I see no reason to treat them special, just like gmail >who think they are above it all, I wont include hotmail in that, as they I suppose you think you're capab

Re: Exclude from RCVD_IN_DNSWL_MED

2012-09-17 Thread Noel Butler
On Sun, 2012-09-16 at 13:30 +0100, Niamh Holding wrote: > Hello Axb, > > Sunday, September 16, 2012, 1:18:59 PM, you wrote: > > A> They are 100% whitehat > > Why do we see repeat spams from the same customers of theirs? Further > they never even acknowledge reports of spams from their servers.

Re: Exclude from RCVD_IN_DNSWL_MED

2012-09-17 Thread Noel Butler
On Sun, 2012-09-16 at 14:18 +0200, Axb wrote: > > why should we treat messagelabs any different, they are no more special > > than anyone else who connects to you. > > Depending on your user base, by blocking MessageLabs you'd miss LOTS of > corporate mail. A "man & his dog" setup may not see F