cancel
Showing results for 
Search instead for 
Did you mean: 

no spam since migration, how do I find false positives?

pierre_pierre
Grafter
Posts: 19,757
Registered: 30-07-2007

no spam since migration, how do I find false positives?

I used to get at least 10 spams a day on postini, now none in two days.
In the last three months I also had 7 false positive - where will they go now, since most were from commercial companies with useful information I dont want to loose them
27 REPLIES
Superuser
Superuser
Posts: 8,883
Thanks: 411
Fixes: 36
Registered: 06-04-2007

Re: no spam since migration, how do I find false positives?

Messages flagged as spam should go into the Spam folder (assuming you have selected that option in MMM) just like they always have done. A reduction in spam post migration is one of the expected advantages of IronPort filtering compared with Postini's. Another advantage is reduction in false positives, but only experience will demonstrate that. I can confirm my spam is going to the Spam folder, as it should, but I'm also getting much less of it (one in the 24 hours post migration instead of the normal dozen).
IronPort rejects mail based on 'Reputation'. An explanation of what makes a good reputation can be found here. More detail about IronPort's filters themselves can be found on IronPort's website here.
David
David
Community Veteran
Posts: 3,789
Registered: 08-06-2007

Re: no spam since migration, how do I find false positives?

My experience is similar - I guess I used to get around 100 marked spam emails per day.
Since migration, (and since the McColo incident) I'm lucky (!) if I only get 1 or two marked spam emails per day, and I'm certainly not missing anything that I'm expecting.
B.
Community Gaffer
Community Gaffer
Posts: 12,808
Thanks: 636
Fixes: 62
Registered: 04-04-2007

Re: no spam since migration, how do I find false positives?

Absolutely! IronPorts reputation filters are hugely efficient and this reduction in email is something we've seen as part of the internal testing too. The links spraxyt has provided are certainly worth a read if you're interested about finding out more about how this works.
Turning the spam filter off via Manage My Mail now *completely* bypasses the IronPort boxes. You can always turn everything off if you genuinely believe you're losing legitimate email but this would surprise me TBH as IronPort are really good at what they do.
I understand that some people are going to be apprehensive at first, but I'm soundly confident that this apprehension will lapse after peoples' confidence has built up a bit.

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

pierre_pierre
Grafter
Posts: 19,757
Registered: 30-07-2007

Re: no spam since migration, how do I find false positives?

@Spraxyt  Did the test, got through as normal.  My Daughter did it from work, said how do I spell Viagra, said why dont you know, said no never look at the box.  So I am still not the wiser.
@Bob would you like a couple of my Postini false positives from recent all from reputable firms
Community Gaffer
Community Gaffer
Posts: 12,808
Thanks: 636
Fixes: 62
Registered: 04-04-2007

Re: no spam since migration, how do I find false positives?

Quote from: pierre_pierre
@Bob would you like a couple of my Postini false positives from recent all from reputable firms

I'm not sure how that's relevant? Huh

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

Moderator
Moderator
Posts: 25,684
Thanks: 1,079
Fixes: 46
Registered: 14-04-2007

Re: no spam since migration, how do I find false positives?

Aha...now I'm seeing IronPort references in the header of inbound mail on my enabled account Smiley
Quote
X-SBRS: 2.8
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AqAFAC//MElBNvajgGdsb2JhbACCRSuDZYxzAQELCwoYA64xgSoIihmBdgh/
X-IronPort-AV: E=McAfee;i="5300,2777,5448"; a="474867"
X-IronPort-AV: E=Sophos;i="4.33,687,1220223600";
     d="scan'208,217";a="474867"

Has everyone been migrated Embarrassed
Customer and Forum Moderator.
Product of the Tyrell Corporation
I see dead Parsnips.
Community Gaffer
Community Gaffer
Posts: 12,808
Thanks: 636
Fixes: 62
Registered: 04-04-2007

Re: no spam since migration, how do I find false positives?

Quote from: Strat
Has everyone been migrated Embarrassed

No.

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

oliverb
Grafter
Posts: 606
Registered: 02-08-2007

Re: no spam since migration, how do I find false positives?

Tricky one this, I'm finding it uncannily quiet too considering the 60+ correctly tagged spam, 5 or so missed and the odd false positive I used to get.
softrader
Dabbler
Posts: 16
Registered: 04-12-2008

Re: no spam since migration, how do I find false positives?

I've just received notification of transfer to ironport after a suspiciously quiet day. Two expected emails have not arrived, one from a new contact who was going to send full contact details. If I don't respond, I have to hope they will call again and not send a follow-up email.
Email is often my only channel of communication with some of my world-wide customers, and orders from an American dealer were regularly flagged as [SPAM] by Postini in spite of my best efforts.
Am I right in thinking that nothing marked as spam will be sent through. Do I have to switch off spam filtering to ensure I receive all messages.
I'll bet I'm a better spam filter than any software and I don't have the expertise (nor time) to analyse headers and track faults.
pierre_pierre
Grafter
Posts: 19,757
Registered: 30-07-2007

Re: no spam since migration, how do I find false positives?

if you switch spam filtering off all mail will go to the envelope address, then you will have to sort it out.  I think even then if Ironport think it is blatent it will get dumped.  still doing my own tests as PN dont seem interested in helping us out of this mess once again
pierre_pierre
Grafter
Posts: 19,757
Registered: 30-07-2007

Re: no spam since migration, how do I find false positives?

some of my false positives with Postini, as I understand it all these would be lost with IronPort
these were random false, normally I would have got them
Superuser
Superuser
Posts: 8,883
Thanks: 411
Fixes: 36
Registered: 06-04-2007

Re: no spam since migration, how do I find false positives?

@softrader
Have you checked whether the missing emails are in your IMAP/Webmail Spam folder? Anything tagged as [-SPAM-] should end up there (assuming you have that setting in the Manage My Mail tool).
If you turn off spam filtering on all your domains IronPort is bypassed completely (but note that it can take up to 48 hours for this change to propagate around the Internet) and all mail should then arrive in your Inbox. Unless excessive spam is a problem, turning off spam filtering for the moment might be appropriate for you.
David
Community Gaffer
Community Gaffer
Posts: 12,808
Thanks: 636
Fixes: 62
Registered: 04-04-2007

Re: no spam since migration, how do I find false positives?

Quote from: softrader
I've just received notification of transfer to ironport after a suspiciously quiet day. Two expected emails have not arrived, one from a new contact who was going to send full contact details. If I don't respond, I have to hope they will call again and not send a follow-up email.

Playing devil's advocate here but do you know whether or not they *definitely* sent this email, and if so are you sure they have the right address?
Quote
Am I right in thinking that nothing marked as spam will be sent through.

No, messages marked as [-SPAM-] will still come through, however a lot of spam will be refused before it even gets to this stage with IronPort.
Quote
Do I have to switch off spam filtering to ensure I receive all messages.

Switching spam filtering off *completely* bypasses IronPort. You can expect to get *everything* if you do this.
Quote
I'll bet I'm a better spam filter than any software and I don't have the expertise (nor time) to analyse headers and track faults.

I'll bet any human being is a better spam filter than a machine! Wink
Quote from: pierre_pierre
if you switch spam filtering off all mail will go to the envelope address, then you will have to sort it out.  I think even then if Ironport think it is blatent it will get dumped.

That is not the case at all Pierre. If the spam filter is switched off, then your mail goes nowhere near the IronPort servers.
Quote
Still doing my own tests as PN dont seem interested in helping us out of this mess once again.

Pierre, we now have 302684 unique users on IronPort with 81680 still to migrate. That equates to just short of half a million domains. All but 50,000 of these customers have been emailed and provided with a link to this forum in the event that they're having problems. If things were as bad as you're implying then I'd expect this forum to be flooded with complaints and the support centre would also be getting hammered which they're not. Don't get me wrong, I'm willing to accept that there might be problems, in fact I'd fully expect there to be with an exercise of this magnitude. What I don't understand is why you think we're not interested in getting to the bottom of them? Undecided

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

Community Veteran
Posts: 3,486
Registered: 02-10-2008

Re: no spam since migration, how do I find false positives?

Lukily - my spam levels have been low for some time, and this move to Ironport has ben trouble free.
But I did get a couple of suspect emails today - which I just deleted.
Do PN want us to feedback these suspect emails - or would that be too much load on you ?Huh