Rules working too well

[Carl Gross]

I have Exchange Server 2003, SP 2 with Outlook 2003 SP3.

We have been getting a lot of SPAM for sexual pleasure products. I put a
rule on some people's machines to delete them and those I put them on have
been deleting good e-mail that don't violate the rule at all, as well as the
offending ones.

Why would that happen?

 

[Diane Poremsky [MVP]]

Are you sure that is the rule that is the problem? (set it to flag instead
of delete to test)
What keywords does it contain?

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
mailto:[email protected]

EMO - a weekly newsletter about Outlook and Exchange:
mailto:[email protected]

 

[Vince Averello]

What criteria are you using?

 

[Carl Gross]

I was telling it to look for viagra, VIAGRA, Viagra, Cialis, cialis, CIALIS,
pfizer, Pfizer, PFIZER and then delete them. Somehow it also checked the
"Stop processing more rules" box without me doing it.

I told it to delete it until I found out I wanted some of the e-mails, then
I changed it to "Send to Deleted Items folder" and found lots of them I
wanted. I removed the rule and am now getting all my e-mail (SPAM included).

As an aside, how does someone send me e-mail that comes from me? I would
really like to know.

 

[Carl Gross]

I changed the "actuion to take" to "Send to Deleted Items folder" and found
good mail as well as SPAM was being sent to Deleted Items. I have since
removed the rule and it is now delivering everything.

I thought that was a pretty good indication of what was causing the problem.

Are you sure that is the rule that is the problem? (set it to flag instead
of delete to test)
What keywords does it contain?

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
mailto:[email protected]

EMO - a weekly newsletter about Outlook and Exchange:
mailto:[email protected]

I have Exchange Server 2003, SP 2 with Outlook 2003 SP3.

We have been getting a lot of SPAM for sexual pleasure products. I put a
rule on some people's machines to delete them and those I put them on have
been deleting good e-mail that don't violate the rule at all, as well as
the
offending ones.

Why would that happen?

 

[Diane Poremsky [MVP]]

Stop processing is good - that prevents additional rules from applying to
the spam. The rules should be case insensitive, so you only need each
spelling variation once.

Spammers put the victims address in the from field because it’s a valid
address and most people accept mail from themselves. If you never send
yourself mail, use a rule that deletes mail to and from your address. If you
use 'send this page' sites, use a different from address to send to
yourself.



--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
mailto:[email protected]

EMO - a weekly newsletter about Outlook and Exchange:
mailto:[email protected]

 

[Duncan McC]

Not answering your question, it's well covered by the others, but...

Are you using Exchange Server's built in spam filtering methods?

If not, why not? - it'll surely stop, in my experience, about 98% of
spam.

Two things you can set in Exchange Server...
a) Connection Filtering, in Global Settings, Message Delivery: add
zen.spamhaus.org
b) IMF, same place as above, on the IMF tab