Hey there,
I realize this is an older thread, but I have a similar situation with our Content Filtering. First, some background.
We're using SmarterMail Professional Edition Version 4.3.3048. We've placed an SPF record in our DNS, and we've made sure to disable (uncheck) the "Skip spam filtering on intra-domain email" function. We also use MS Outlook 2007 on our local systems to pull mail from the SM server, but since we only 'pull' with this client, this shouldn't affect the way the SM filters work anyway (of course I'm open to being proven wrong).
Now, we have a Trusted Senders (TS) list, but we found a way to properly create a Domain Content Filter (DCF) that filters out these 'spoofed' emails, the only thing is, there's one area that's a bit flaky, so I wanted to make sure we haven't missed anything by explaining the DCF setup.
So, we created a DCF to run against any Trusted Senders by checking the appropriate boxes [checked 'From TS's' box under 'From Address', checked 'Subject or Body Text, box under 'Contains Specific Words or Phrases'] - and then the MAJOR trick is to make sure that the "AND - All criteria must be met" radio is chosen, NOT the OR one (I also use the "Use wildcards in search strings ( * and ? )" setting too). Also, when you're done, we made sure this DCF is at the top of ALL the other DCF's.
So now, it's worked pretty awesome so far (we're down from 300 of these a day, to about 20 now), but there's one type of spam that's getting thru. You know the ones with only a random Subject and just an image in the body text (i.e. some male enhancement pill), and no matter what we tried (adding basic phrases to the Subject/Body entries, with wildcards as well), they still gets thru.
The only other difference with these ones are that they're listed in our MS Outlook as "This message was sent with High Importance", so we went back and checked the "Flagged as high priority" box under 'Other' in the DCF settings, but that hasn't helped.
I know there's always chalenges with filtering out Spam, and you never get 100% of it, but is the 'high priority' setting incorrect, and/or are there any other settings that I could use for this?
Any responses would be appreciated.
Thanks much.