Good question! Just checked, but we're applying it to all the groups except one and from the header stamping we do, the junk isn't coming in as that group, thankfully.

Thinking further, I guess putting the junk through a trace would be a good idea too, as we could then see what the IP boxes think of it then..

I think it's better to use several CASE policie's ( at least 2) with different scores and put spam recipients/sender into more strict policy (less scores). Have anyone an another ideas ?

If you are going to use different CASE Policies (with Different Scores) then you have to have multiple Mail Policies each with a different Anti-Spam Setting, and the complex way you would have to put the senders into the different policies (Email Address or LDAP group), is going to put an overhead on the appliances and be a pain to manage.

The best way we have found is to drop the messages from the senders with a low SBRS (Around the -2.5 mark is good). For us that drops about +80% of the message at the Gateway (and saves a hugh amount of overhead on the appliances).

At the other end of the scale we don't apply the CASE engine to the senders with a very good score.

This works very well for us and the 30 Million messages we process in a month. The false positive rate for the messages we drop is about 0.00002%.