Re: A Question

[Piet Beertema <]

    Certainly if you want to keep all your filters in one place
    then you can force all your mail through a single machine
    and then vector it off to other internal systems afterwards.
    That's a fairly common configuration anyway for reasons other
    than spam-blocking.
The question remains though whether or not you want *all*
filtering to be done centrally. The approach I've taken is
to have most of the filtering based on *envelope addresses*
be done centrally, with additional ('personalised') filtering
being left up to the user; this additional filtering can use
the envelope and header addresses. Just to give you an idea
of what my 'personalised' filter treats as spam (addresses
treated case-insensitive):
- header-from address identical to header-to address
  (incidentally, I've had 2 cases where a 'vacation'
  message was seen as spam, because the remote user
  had pre-filled the To: line with his own address);
- underscore in domainpart of from- or to-address;
- empty from-address or to-address;
- space or tab in localpart;
- localpart consisting of 8 digits;
- localpart consisting of any of the names "everyone",
  "friend" or "user".
The combination of the central and 'personalised' filters
is quite effective: I've seen upto 80 messages per day
blocked or discarded this way.


	Piet