Training the Filters

As PerfectMail™ is mostly self-tuning, there are few tuning chores to distract administrators from their other duties. In fact, most PerfectMail products are run lights out (without administrator involvement) after their first week of service.

PerfectMail's inherent accuracy is enhanced by its embedded reputation system. PerfectMail's reputation system helps ensure the highest overall accuracy (typically better than 99.9+% and zero false positives). PerfectMail auto-discovers protected e-mail users and peers as well as legitimate and malicious mail servers. It watches live activity to make the best overall decision.

Let PerfectMail watch your e-mail traffic, both inbound and outbound, for about a week. After that use the web interface to review how your messages have scored. Look at the messages that score around your reject and tag thresholds. After about a week you can start lowering these thresholds. Lower the scores by about 2 points. Depending on your traffic, this will have a huge impact on the amount of spam that comes through your system. Then for the following couple of weeks perform this exercise again, dropping the scores 1 or 2 points, watching for any false rejects, until you find an acceptable setting.

Threshold Values

Administrators must assign values for the Tag and Reject thresholds for each domain protected by PerfectMail. It is common practice to start with higher values, to ensure no false positives (legitimate mail rejected as unwanted) and then adjust values down over time. Higher initial values will allow some amount of unwanted e-mail (spam) to sneak in under the Tag and Reject thresholds. Over time, reduce these to safe long-term values for Tag and Reject thresholds.

PerfectMail's reputation system will learn your users and their peers with a few days to a few weeks of service. Because PerfectMail strongly favors users and peers with an established reputation, it is safe to reduce Tag and Reject thresholds without the risk of introducing false-positive scores.

Optimal settings need to be determined empirically because each PerfectMail interacts with a unique set of users, mail peers and mail servers. To assist you, we suggest the following settings based on our own experience with the product:

Note that scores have no meaning other than to indicate the magnitude of suspicious or undesirable activity discovered within a message. The overall range of scores that you might encounter is –50 or less for messages between peers with well established history, to 50+ for messages from one-time senders of strongly objectionable content.