X WALL Question, I dont understand

[staboogie]

I just downloaded x wall to try out on my exchange server tonight. Do I have to be subscribed to black lists for it to work? Does anyone know of any free black lists? Any other advice about x wall or what to look out for is very welcomed.

 

[cmeagan656]

sbl.spamhaus.org and relays.ordb.org. They're free and are the ones we use with XWall. The documentation is really good for setting up XWall so you shouldn't have too many problems.

A couple of suggestions:

For the first 3 to 4 weeks run XWall so that everyone gets their emails which would have been bounced by XWall. That way the users can see what is going to be bounced when you go "live" and alert you of any accidental blocks. You can set it so that the subject will be prefaced by the reason the message would have been bounced.

I don't know how many mailboxes you had but we have 22 and what we did was have everyone export their contacts to a csv file and forward it to us. We then entered all the contact email addresses into the white-list. Its not as big a job as you might think because you can edit the csv file and then just copy and paste.

Good luck!

 

[staboogie]

Thanks, do you think I will lose emails if I don't do the whitelist procedure? I've got no problem doing that but it will take some time to gather all the info from my users. Is it worth using this before I get the whitelist together?

 

[cmeagan656]

As long as you use don't run it "live" for the first 3 or 4 weeks you should be fine. Be warned it does take a fair amount of time to configure it to get working the way you want. We installed ours last July and we're still making adjustments to it. The spammers always seem to be one step ahead of us.

The way we configured XWall (we were pretty aggressive right from the start) if we hadn't run 3 or 4 weeks before going live and whitelisted the contact lists we would have had about 40% of legitimate email blocked.

Make sure your users know to tell you when something that isn't spam is being tagged as such. We created a separate mailbox, for internal mail only, called notspam@ourdomain.com for our users to forward emails that were being tagged as spam but weren't spam to. Then we could check both the sender's address and XWall log (in case the sender had a different snd: address)and whitelist what we needed to.

Cheers.

 

[spamfilter]

You simply start the Xwall Admin, goto OPTIONS, SPAM, check the first box (enable lookup) then click the button "Add common". This will add 4 spam lookup services. For the first week set the action to mark subject so you can keep an eye on it. In addition you should enable some blocks like email addresses, domains, text and subject but start conservative. Once you have the filters working good start the Bayes filter in learning mode. (admin-options-spam-bayes). After a week you can set the Bayes in active mode and it will help to catch additional spam. You will find more resources at

http://www.xwall.us

There is now a companion product for Xwall called ESATInformer. It helps the admin set the filters and offers automatic false positive retrieval to the users.

 

[staboogie]

I started xwall up. Also forwarded email from the exchange server to it so it can make the automatic whitelist. Then I saw all of the NDR that are normally in my exchange queue sending out. I stopped forwarding to the xwall server. Does this mean I've been sending out these this whole time? I dont allow any relays to my exchange server at all so I'm not sure how this would happen. Is there a way to check and see if my company's on a RBL?

 

[cmeagan656]

Go here

http://www.dnsstuff.com/

and enter your mail server's IP in the spam database lookup.

Cheers.

 

[devastator]

Probably get your answers better at the X-Wall Forum.

http://www.xwall.us/phpBB2/index.php