The Exclaimer Community

I have Exclaimer’s anti-spam function set up in End User mode, and I have collected a few reports already of valid e-mail that has been marked as [SPAM], [BULK], or [SUSPECT].  To deal with the few reports so far, I have created white list entries to allow those e-mails to be received without being marked.  However, the procedure for doing this is not as clear as it might be, and I am not sure if some of my entries will be effective.  I have tried using the wizard, but so far I have not been able to get the wizard to activate the last button to Finish and add the white list entry.  Apparently, it doesn’t like what I have specified for parameters to allow the e-mail to be accepted.  I have created several white list entries without using the wizard, but there is only one that I am reasonably sure is actually working.  That one was specified by using a specific IP address for an organization whose e-mails are all sent from that specific address.  Since that IP is unlikely to change very often, if at all, the white list entry for it should be effective for our needs.  However, some guidelines on how to set up white list entries for other e-mails might be useful.  In most cases, all I have to go on is a sent-from e-mail address.  IP addresses would not work since they are likely to change too often.  Testing the effectiveness of white list entries also presents a challenge, since I have already have some e-mails from one address listed as [BULK] while others were not listed.  From what I have been able to see, it looks like the e-mails listed as [BULK] were sent using a list of contacts, while the e-mails not flagged were not.  Any ideas or suggestions on how to create effective white list entries would be appreciated.

Thanks.

Hi,

Managing the whitelist can sometimes leave you wondering as there are no immediate results. The best way I find is to click the Add button (version 4.24 and above) directly and enter the details into the screen there.

If you use the p1 SMTP Envelope data, this can not be synthesied easely. The MAil from should hold a domain in the following format *@domainname.com

The recipient can be left blank, or if you have 1 domain you can use *@yourdomain.com. I would advise that you use the SPF_PASS feature as this will limit the number of false positives that get through. The SPF is basicaly used as an extra blanket to be safe.

If you are unsure of hte IP address of a sender you can use the resolver in the IP address box. Just place the domain name in there and use the resolve button. This in turn will allow you to get the full range of IPs that are used by that mail server.

In regards to the classification of bulk mails. What you are describing is not impossible. Emails that are sent to large distribution list do behave like spam mails (multiple recipients identical email). There is a very fine line between a spam and a distribution list, and our detection center is working very hard to minimize the false positives.

I hope that this helps

regards

Richard

Thanks for the reply.

From your information, it looks like I was setting up the whitelists entries correctly.  The SPF_PASS checkbox might be useful in eliminating spam that happens to arrive with a spoofed From address matching one of the whitelisted addresses.  This isn't too likely to happen in our case, but it is possible.

As for as the valid e-mails received from mass mailers or that were sent using address lists, I'm still not sure what to do about these.  While it is possible to compile a list of valid mass mailers, that would require a large full-time staff to compile and maintain.  It looks like I will have to leave the anti-spam feature in End User mode for at least two months in order to try to detect all of the valid e-mail messages that may be sent to us on a once per month basis that get flagged as Bulk, Spam, or Suspect.  The difficulty with this is getting the end users to report them.  If it is possible to log all of the flagged e-mails with at least the From and To e-mail addresses, it might be possible for me to review the log file to see if there are any potential false positives that need further research.

Update:

It appears that the method I have used for one of the e-mails I received that was labelled [BULK] did not work.  I received another e-mail from the same source after creating a whitelist entry, and that e-mail was still labelled [BULK]  I have attached an image of the whitelist setup window with the settings I have used.  Any ideas as to what changed I would need to make to get e-mails from this source to be accepted would be appreciated.

Thanks.