cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1133
Views
0
Helpful
2
Replies

request for feedback - SPAM thresholds for Ironport AntiSPAM and IMS

marc.luescherFRE
Spotlight
Spotlight

We have been running Ironports now for 15+ years and have constantly being tweaking our SPAM levels. We have seen a large increase in SPAM delivered to our end users over the last 7 days and are wondering how other larger customer are using the AntiSPAM thresholds and if we are alone to see this.

 

Our current values are :

 

Ironport AntiSPAM

Default 90 for positively identified spam and 50 for suspected spam

Ours    80 for positively identified spam and 38 for suspected spam (based on Cisco heath check)

 

IMS

Default 90 for positively identified spam and 50 for suspected spam

Ours    85 for positively identified spam and 45 for suspected spam (based on Cisco heath check)

 

IMS appears to rate more agressively compare to Ironport AntiSPAM, using the lower values resultet in

false positives. For those who use custom value in production how far do you go ?

 

-Marc

2 Replies 2

joelbland
Level 1
Level 1

For Anti-Spam we're using 

Positive > 75
Suspect > 40

 

We used the defaults(90/50), but also quarantine all "Marketing" and "Bulk" as defined by the Graymail filters...

I'd have to go do some analysis, but the stuff that's missed by the "spam" definition is probably getting caught by that...



Ken




Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: