RE: Zimbra+SPAM=...?

["Mike Perin" <mike.perin@drake.edu>]

You definitely can't beat Ironports as they are the gold standard, however 
we have went with Proofpoint appliances instead due to the high cost of 
Ironport.  We have been very happy with Proofpoint and its done a great job 
in stopping a majority of spam on campus.

Thank you,

Mike Perin
NETWORK ENGINEER II, COMPUTER AND NETWORK SERVICES


-----Original Message-----
From: Matt Mencel [mailto:MR-Mencel@wiu.edu]
Sent: Monday, August 16, 2010 10:44 AM
To: zimbra-hied-admins
Subject: Re: Zimbra+SPAM=...?

Ditto on the use of Ironport.  It's expensive but worth every penny.  We 
spend very little time fighting SPAM anymore and the customers don't have to 
bother with "training" personal filters.

Matt


----- Original Message -----
From: "Brian Elliott Finley" <finley@anl.gov>
To: "Dmitry Makovey" <dmitry@athabascau.ca>
Cc: zimbra-hied-admins@sfu.ca
Sent: Monday, August 16, 2010 10:20:04 AM
Subject: Re: Zimbra+SPAM=...?

We use edge appliances (Ironports), and are very very happy with them.
Our level of spam fighting effort has dropped dramatically since we
started using them.  They have easily paid for themselves.

Internally, we still do virus scanning on Zimbra.

-Brian


On 08/16/2010 10:07 AM, Dmitry Makovey wrote:
>
> Hi everybody,
>
> we're trying to figure out the most efficient way of dealing with SPAM in 
> Zimbra
> (we have edge MTA handling some of it too). What we're trying to find out 
> what
> are the common practices in HiEd institutions? I'll bring some examples:
>
> * do you let users "train" your Bayesian by marking mail as "Junk"?
> * do you flush your Bayesian DBs every once in a while (and how often)?
> * do you solely rely on Edge MTA for SPAM filtering and do only 
> pass-through in
> Zimbra?
> * etc. etc. etc.
>
> We think our SPAM-filtering setup at present can't keep up with SPAM and 
> we
> have either lots of false-positives or the contrary - lots of 
> false-negatives.
>
> I've seen some opinions that you shouldn't double-filter with Bayesian as 
> your
> second instance would be "starving" and will not perform as expected. I 
> also
> have met with opinions that you shouldn't do rule-based filtering and rely
> solely on Bayesian. Another opinion was that Bayesian is strictly a 
> personal
> tool and you can't apply one SPAM/HAM DB across institution because
> preferences of HR clerk are different from Prof's and yet different from 
> IT
> professional due to the different vocabularies of incoming mail. And so on 
> and
> so forth.
>

-- 
Brian Elliott Finley
Manager, Application Platforms - Infrastructure and Operations
Computing and Information Systems,  Argonne National Laboratory
Office: +1 630.252.4742  Mobile: +1 630.447.9108