Re: Zimbra+SPAM=...?

[David Emmerich <dpemmerich@eiu.edu>]

We use Ironport for spam and barracuda for viruses.  The main reason we have 2 appliances is because we had barracuda doing both, but found ironport to be better for spam.  The cost of AV scanning on ironport was just too much compared to doing only AV on barracuda.

David Emmerich
----------------------------------------------
Manager ITS User Services
Eastern Illinois University

----- "Mike Perin" <mike.perin@drake.edu> wrote:

> You definitely can't beat Ironports as they are the gold standard,
> however 
> we have went with Proofpoint appliances instead due to the high cost
> of 
> Ironport.  We have been very happy with Proofpoint and its done a
> great job 
> in stopping a majority of spam on campus.
> 
> Thank you,
> 
> Mike Perin
> NETWORK ENGINEER II, COMPUTER AND NETWORK SERVICES
> 
> 
> -----Original Message-----
> From: Matt Mencel [mailto:MR-Mencel@wiu.edu]
> Sent: Monday, August 16, 2010 10:44 AM
> To: zimbra-hied-admins
> Subject: Re: Zimbra+SPAM=...?
> 
> Ditto on the use of Ironport.  It's expensive but worth every penny. 
> We 
> spend very little time fighting SPAM anymore and the customers don't
> have to 
> bother with "training" personal filters.
> 
> Matt
> 
> 
> ----- Original Message -----
> From: "Brian Elliott Finley" <finley@anl.gov>
> To: "Dmitry Makovey" <dmitry@athabascau.ca>
> Cc: zimbra-hied-admins@sfu.ca
> Sent: Monday, August 16, 2010 10:20:04 AM
> Subject: Re: Zimbra+SPAM=...?
> 
> We use edge appliances (Ironports), and are very very happy with
> them.
> Our level of spam fighting effort has dropped dramatically since we
> started using them.  They have easily paid for themselves.
> 
> Internally, we still do virus scanning on Zimbra.
> 
> -Brian
> 
> 
> On 08/16/2010 10:07 AM, Dmitry Makovey wrote:
> >
> > Hi everybody,
> >
> > we're trying to figure out the most efficient way of dealing with
> SPAM in 
> > Zimbra
> > (we have edge MTA handling some of it too). What we're trying to
> find out 
> > what
> > are the common practices in HiEd institutions? I'll bring some
> examples:
> >
> > * do you let users "train" your Bayesian by marking mail as "Junk"?
> > * do you flush your Bayesian DBs every once in a while (and how
> often)?
> > * do you solely rely on Edge MTA for SPAM filtering and do only 
> > pass-through in
> > Zimbra?
> > * etc. etc. etc.
> >
> > We think our SPAM-filtering setup at present can't keep up with SPAM
> and 
> > we
> > have either lots of false-positives or the contrary - lots of 
> > false-negatives.
> >
> > I've seen some opinions that you shouldn't double-filter with
> Bayesian as 
> > your
> > second instance would be "starving" and will not perform as
> expected. I 
> > also
> > have met with opinions that you shouldn't do rule-based filtering
> and rely
> > solely on Bayesian. Another opinion was that Bayesian is strictly a
> 
> > personal
> > tool and you can't apply one SPAM/HAM DB across institution because
> > preferences of HR clerk are different from Prof's and yet different
> from 
> > IT
> > professional due to the different vocabularies of incoming mail. And
> so on 
> > and
> > so forth.
> >
> 
> -- 
> Brian Elliott Finley
> Manager, Application Platforms - Infrastructure and Operations
> Computing and Information Systems,  Argonne National Laboratory
> Office: +1 630.252.4742  Mobile: +1 630.447.9108