More false positives in junk mail lately - reset needed?

Question asked by Neal Culiner - 11/6/2015 at 8:38 AM

Unanswered

Hello,

I'm using SM 14.4.5784 Enterprise and recently I'm seeing a rise in false positives to where we have to watch our junk e-mail folder daily. I have my filters set up per Bruce (I think that's his name??) and also use the message sniffer add-on, all has been working great. Is SM "learning" or does it just use the filters / systems as is? Is there something to reset or clear to resolve something like this? Nothing has changed but the SM software and I'm concerned with the higher false positives I'm seeing.

6 Replies

Reply to Thread

kevind Replied

11/6/2015 at 9:28 AM

Neal, take a look at the headers of the false postive messages. At the bottom will be a spam score. You can see which test(s) is causing it to be classified as junk and then reduce the score for that test (or just turn it off).

Neal Culiner Replied

11/6/2015 at 9:45 AM

Great idea - thank you.

Richard Frank Replied

11/13/2015 at 5:28 AM

Neal, do you still experience this problem? I'm seeing this happening too. And the delivery log shows it's message sniffer.

Bruce Barnes Replied

11/13/2015 at 6:12 AM

Make certain you are on SmarterMail 14.4.5793.28950 - it's a special build and on the SmarterMail pages in the forums. You'll need that to handle SPF, DKIM and DMARC exceptions which were causing false positives and were fixed.

In my experience, use nothing except the SmarterMail antispam, setup per my document.

Do not allow users to override spam settings. Enforce Greylisting, and shut down all other antispam.

I will have it updated, to reflect additional spam from new domains, next week.

See: https://portal.chicagonettech.com/kb/a171/smartermail-antispam-settings-document.aspx

Bruce Barnes

ChicagoNetTech Inc

brucecnt@comcast.net

Phonr: (773) 491-9019

Phone: (224) 444-0169

E-Mail and DNS Security Specialist

Network Security Specialist

Customer Service Portal: https://portal.chicagonettech.com

Website: https://www.ChicagoNetTech.com

Security Blog: http://networkbastion.blogspot.com/

Web and E-Mail Hosting, E-Mail Security and Consulting

Neal Culiner Replied

11/13/2015 at 6:49 AM

Thanks Bruce - I show 5787 as the latest (and in use by me) but see you're linking to a custom build so I'll install that one now.