Large amount of spam being delivered

[mkongsiri]

The EFA console is showing large amounts of spam being delivered as safe. They are obvious spam messages all of them are scoring below 3 for SA scoring. I just put the system up yesterday morning, is this normal for a new installation? What is the normal procedure when spam is passed as normal email, do I blacklist sender? Do I hit the SA Learn as spam and submit?

[shawniverson]

Use both strategies

[colin]

IMHO blacklisting is a complete and utter waste of time. How many spammers send from the same address in more than one batch?

[darky83]

Enabling grey listing will probably filter out a whole bunch.

And also a new system will never be as good as a system that is already running for a while as the SA database is empty.
So let the system learn and over time it will be better.

Also make sure the system has access to the internet so it can consult RBL's and Razor/Pyzor.
I have seen a few cases where the system was only allowed to mail out, this will prevent the system from checking the RBL's and Razor/Pyzor and thus working not as good as expected.