Slashdot Mirror

Yeah - basically everyone's doing more direct anti-spam (e.g., this product, which just applies DNSBL and SPF checks, either using IIS SMTP or Exchange SMTP).

Meanwhile, the anti-spam filtering in Outlook causes emails to end up in the junk folder that shouldn't -- e.g., internal plain-text notifications. (That's actually an issue for business email - if an email doesn't get through to the inbox, we want the original sender to know their email didn't get through, rather than just languishing unread in a junk mail box. ORF will actually reject the spam as part of the initial SMTP connection, meaning false positives are bounced back to the sender.)

We use it - blocking on 'fail' and 'softfail'. We use ORF, and the SMTP response explicitly includes "Contact postmaster@mydomain for help if needed" (and we've configured ORF to always whitelist emails to that address irrespective of SPF status.)

Yes, the spec is a bit broken (softfail?) but it's wider accepted than DKIM.

i was in a similar situation. ~50 users, gfi mailessentials. the software is bad -- you have to get away from it. there are too many bad things to list. try following the support forum for a month or so, and see how much progress gets made..

i moved to vamsoft's "orf filter". this cuts out about 98% of the spam at the MTA level, as god intended. (gfi accepts all mail, period, and then backscatters NDRs out into the world.)

i left gfi in place for awhile after installing orf and used it strictly as a categorizing filter, moving everything to the users "junk e-mail" folder.

eventually i replaced gfi with spamassassin for windows (http://sawin32.sourceforge.net/), an exchange event sink to score the messages before they were accepted (http://www.christopherlewis.com/ESA/ExchangeSpamAssassin.htm), and the mailshell event sink to move tagged messages to the users junk folder (http://www.mailshell.com/mail/client/oem2.html/step/exchangeplugin).

aside from vamsoft, which is extremely reasonable in price, these are all $free solutions which work incredibly well. orf blocks most spam at the MTA. anything that makes it past is categorized by spamassassin, put in the user's folder, and it becomes the user's problem. the users manage their own email, without anyone else looking at it. better for them (privacy), better for me (don't have to deal with it). the change was essentially transparent for the users; they only noticed that they were getting less junk.

i still follow the gfi support forum, but it's mostly just to chuckle. i'd love to share some of this with the folks who are struggling with the software, but any post that suggests a different, non-gfi solution is quickly deleted -- i understand they need to try to keep the rats on the sinking ship, but the censorship it pretty hard to stomach.

anyway. hope this helps.

I agree! ORFEE blocks about 75% of incoming SMTP conenctions for me. The tremendous advantage of ORFEE over a lot of other anti-spam filters is that it can (and does by default) block at the SMTP level (ie, generates a 500 series error instead of 200 okay).

This means that should you accidentally block a legitimate email, the original sender will be notified as their system will send a bounce, but you won't waste everyone's time sending out non-delivery-reports to spam with forged senders.

(The usual approach of merely deleteing email means that a false postitive will be silently lost, and if you tag of otherwise classify spam, user will just ignore/delete everything tagged spam meaning a false postive also won't be noticed.)

Oh, the price is $198 USD per server (unlimited mailboxes, discounts for more servers), including a free 1 year upgrade and support (and Vamsoft do monitor and respond to questions in their very active support newsgroup.) Only servers accepting SMTP connections from the Internet need an installation; a pure back-end server doesn't need one.

It's brilliant, simple, does what it does well, plugs into Exchange or Microsoft SMTPSVC, can optionally intergrate ClamAV or SpamAssassian or other third party programs into the mail flow, DNSBLs (which is the product's original focus), greylisting, SURBL support, HELO/EHLO string scanning, IP Blacklist, Automatic-sender-whitelist (allow addresses that your users send to to reply even if they're on a DNSBL), SPF (Classic) scanning (!), Active Directory address verification (reject incoming sessions to non-existing addresses instead of generating a bounce message later), attachment verification (eg: reject all emails with a .exe or .scr attachment!), all with minimal CPU and RAM use.

It does all this, yet the program is a cohesive whole, easy enough to understand, not a bunch of seemingly random things stuck together.

Er, yeah, that's right, if you want to intergrate ClamAV and/or SpamAssassian into Exchange if you're that way inclined, then here you go. :-)

And you can install it on a seperate Windows 2000/2003 box and use Microsoft SMTP service instead of on your Exchange server itself if you want (so long as it can talk to a domain controller it doesn't have to be on an Exchange server to verify that incoming addresses exist!)

I agree! ORFEE blocks about 75% of incoming SMTP conenctions for me. The tremendous advantage of ORFEE over a lot of other anti-spam filters is that it can (and does by default) block at the SMTP level (ie, generates a 500 series error instead of 200 okay).

This means that should you accidentally block a legitimate email, the original sender will be notified as their system will send a bounce, but you won't waste everyone's time sending out non-delivery-reports to spam with forged senders.

(The usual approach of merely deleteing email means that a false postitive will be silently lost, and if you tag of otherwise classify spam, user will just ignore/delete everything tagged spam meaning a false postive also won't be noticed.)

Oh, the price is $198 USD per server (unlimited mailboxes, discounts for more servers), including a free 1 year upgrade and support (and Vamsoft do monitor and respond to questions in their very active support newsgroup.) Only servers accepting SMTP connections from the Internet need an installation; a pure back-end server doesn't need one.

It's brilliant, simple, does what it does well, plugs into Exchange or Microsoft SMTPSVC, can optionally intergrate ClamAV or SpamAssassian or other third party programs into the mail flow, DNSBLs (which is the product's original focus), greylisting, SURBL support, HELO/EHLO string scanning, IP Blacklist, Automatic-sender-whitelist (allow addresses that your users send to to reply even if they're on a DNSBL), SPF (Classic) scanning (!), Active Directory address verification (reject incoming sessions to non-existing addresses instead of generating a bounce message later), attachment verification (eg: reject all emails with a .exe or .scr attachment!), all with minimal CPU and RAM use.

It does all this, yet the program is a cohesive whole, easy enough to understand, not a bunch of seemingly random things stuck together.

Er, yeah, that's right, if you want to intergrate ClamAV and/or SpamAssassian into Exchange if you're that way inclined, then here you go. :-)

And you can install it on a seperate Windows 2000/2003 box and use Microsoft SMTP service instead of on your Exchange server itself if you want (so long as it can talk to a domain controller it doesn't have to be on an Exchange server to verify that incoming addresses exist!)

I've had good luck with ORFEE. After implementing the Greylist, our spam went down about 75%. I then blacklisted the remaining spam-sending networks (only if I knew we wouldn't need to mail them) and it has now been several weeks since I've received a single piece of spam.

It doesn't have an outlook plugin, but we haven't really needed one. It also has a trial version.

One of the features added to Exchange 2003 (from 2000) was DNSBL (DNS blocklist) checking.

So, yes, they DID upgrade to a version of Exchange that includes anti-spam capabilities. Presumably the admins merely added "check spamhaus.org" and some others. Or something.

Turning this feature on would, of course, only be visible to the admins checking the logs.

Microsoft also have released the "Intelligent Message Filter" for Exchange 2003 that's supposed to help filter out spam too.

Since I've see email addresses for employees that have left for years being spammed still (in the logs) I do not believe for an instant that shutting down the mail server like that will work.

We use Vamsoft's ORFEE as our DNSBL and other assorted anti-spam checker. Works well, rejects mail at the SMTP level rather than accept-and-bounce.