Slashdot Mirror
Spam Filtering For Small/Medium Business?
or_is_it writes "The company I work for has been growing dramatically and I've been charged with the task of being the gatekeeper for our GFI Spam filters. This involves manually inspecting the subject line/to/from for all caught messages in each filter rule folder. For a company of about 50 people, in one day the number of spam messages can exceed 2,000. Neglect it for a day and you end up with quite a task on your hands. I've made the rules lax enough so important messages can go through, along with a few stray spams, for which I get bitched at. Tighten the rules up and then maybe an important time-sensitive email never gets to its intended recipient, and I get bitched at. Manually reading through all those subject lines is supposed to prevent that, but I'm only human and genuine messages can easily get overlooked. How do larger organizations deal with the spam issue? I can't imagine having one centralized person manually inspecting everyone's junk-mail header is the optimal solution. Purchasing a different commercial mail filter product is a possibility, but I'd like to hear some anecdotal evidence before jumping ship."
I just run my mail through a google account and it does great spam filtering.
To be honest, for somewhere of that size I'd be tempted to use some sort of client-based filtering (along the lines of spambayes [http://spambayes.sourceforge.net/]) which would put the power and responsibility in the hands of your users.
-- Gaxx
I purchased a Barracuda for my organization of about 120 employees, and it has been fantastic. I fine tuned a few options on the config and it has blocked about 200,000 emails in the almost two months i have deployed it. There are very few false positives, and very few that get through its filters. I actually get calls of gratitude from the end users about how happy they were not receiving any more SPAM messages. The hardest part was informing them the user base on the difference between the mailing lists they were on and SPAM. Barracudas support has been good as well.
Use MailScanner with the MailWatch GUI and after a few weeks or so of monitoring and tweaking, it will run on autopilot and you can sleep well. http://mailscanner.info I have it running on a number of small businesses and they are very happy with it.
I use Apple's mail client on OS X 10.3.9 as my main e-mail, and the junk filtering is only so-so. I set it up so that unless a recipient's e-mail address is in my address book, it should go to the "junk" folder. Still, I get about a half-dozen junk e-mails in my regular mail in-box every day. I looked at the headers and there's nothing hidden in there to suggest that they're forging an e-mail address in my address book, but they still make it through. Seriously, the set-up is very straight-forward, why does it still not work?!?
Taking guns away from the 99% gives the 1% 100% of the power.
SpamAssassin.
http://en.wikipedia.org/wiki/Spamassassin
http://spamassassin.apache.org/
à_à
> maybe an important time-sensitive email never gets to its intended recipient
When will users learn...
Email is not instant messaging - with bad greylisting / random connection reset / busy server, you can get >=2 hours delay. And it's normal.
You cannot win. Redirect the lot to /dev/null and quit.
I've found Greylisting to be very effective... The only issue is that it delays the first e-mail from someone outside the domain by a few mins. http://en.wikipedia.org/wiki/Greylisting
I've had to send emails to recipients within the Australian Defence Force (specifically, the Army), and every email sent from a civilian must include a keyword within the subject line. The keyword is to do with whether or not the information is classified or unclassified. Sure, getting all the clients to send all their emails with [companyname] in the subject line is a little annoying, and may not be possible depending on your circumstances, but the chances of spam having that keyword within it is virtually impossible.
Set up an automated filter whereby anything that doesn't have the keyword in the subject gets dumped into a spam box to be sorted later. If the senders do the right thing, it assures their emails will be directed to the correct person.
This is just one example of active spam filtering as opposed to the passive spam filtering used in IT today.
You moved your mouse. Please restart Windows for changes to take effect.
Whatever solution you get, the simple answer is:
1) Set up the system to put junk mails in a folder the user can see
2) Train the end user to check their junk mails
3) Show the user how to set the spam triggers high or low and what the implications are
If user says they're too busy/important, advise them that due to your workload, their email box will be added to the "manually checked list" which gets done once per week. Point out the impact of losing a time-critical email wrongly flagged.
Most times they do it themselves. For those who are dead set on having someone else do it, hire a temp or arrange for an office junior to do it.
If you're in IT, you have better & more important things to do than check for real mail in a junk mail box...
I left my body to science, but I'm afraid they've turned it down...
I like the way spamassassin works - it can provide a rating for each message, which provides a mechanism for users to set the bar to their own preference, instead of having a single setting for the entire organization.
I'm not talking about using individual configurations for spamassassin, it's not realistic to expect most users to be able to deal with all the gory detail of spam filters.
Rather, spamassassin can set a header to indicate its confidence that a message is spam:It adds an asterisk for each "point" of spam score. Users should be able to create an email filter which picks off suspected spam and puts it into a separate folder based on a header like that. Maybe drop all 10+ messages centrally, and let users tweak a local filter to their liking, depending on whether they prefer false positives or negatives.
I use spamassassin as an example only because that's what I use. There are no doubt others which can provide something similar which users could filter on.
"National Security is the chief cause of national insecurity." - Celine's First Law
You might want to consider using a commercial email filtering service, such as messagelabs.com.
I'd say it really depends on the budget. For 50 users, I'd use hosted solution like from Google Postini which cost about $12 per user per year. The trend nowadays for any spam filtering is really look like going toward SAAS model.
Alternatively, if you prefer an in house solution, you could use Barracuda Spam Firewall, but it still requires some tweaking building the bayessian filter by marking legitimate emails and spam.
Postini.com completely managed service.
Postini's anti-spam service does wonders. We use it for about 200 accounts and people love it. It works, rarely gets things wrong and is simple. IT (me) loves it because spam is no longer my problem. For a fee that would be less than my effort and aggravation is worth, they take care of it. We are currently investigating expanding use to compliance filtering and archiving as well.
For the record, Google purchased Postini in the not to distant past.
Learning HOW to think is more important than learning WHAT to think.
How do larger organizations deal with the spam issue?
I used to work for a mining company you've heard of. Our department had responsibility for managing the email vendor, who used Spamshark to filter spam coming into the organisation. From my limited knowledge of the setup, Spamshark does basic blacklisting etc. but also does selective blacklisting on specific IPs when an email is flagged by a user. So Alice flags a message as spam, Spamshark figures out the message id, grabs the IP address it came from (it knows because it previously handled the email), and then blacklists that IP for a certain amount of time. Now this internal blacklist is then shared to all the other customers who use Spamshark, so they are now protected too; resulting in a 5 nines hit rate on spam.
Like I said we just handled vendor relations, and the above description might not be totally accurate, but this is what I gathered when we dealt with them. I also remember getting about 10 complaints of spam a month for an organisation with 10's of thousands of email addresses - so it was very effective.
"And then I visited Wikipedia
The lack of OCR image scanning is reason enough to ditch GFI. My previous employer sold GFI for years but as it became less reliable we switched to SonicWall Mail Security appliances. They are less expensive than Barracuda, but the accuracy rate has been out of this world. A little secret: the devices don't enforce their license limits. No matter what size you buy (among the smaller units) the devices are the same. I've found that the device works fine as is, but if your company gets a lot of spam (say 200+ daily per person) you might want to enable at least one DNS black list. I usually added the entire sorbs DNS black list. I also set up catch all email addresses (john.smith@xxxx.com) that the device uses to train itself. The device reads all email sent to these nonexistent users and uses it to identify spam/train itself for everyone else. The device can be configured to send daily summary emails that users can read and unjunk directly from the email if need be. In all honesty after a few months the users will find it so accurate that they will just ignore the email alltogether. Make sure you update it out of the box, they never ship them with the current hd image). You can view the web UI at the SonicWall site, they have a demo unit set up. The device costs more than GFI (about 2G up front for the smallest unit, a few hundred a year to renew the updates) but trust me it will pay for itself in terms of less spam management labor all around. I've installed/configured about 20 of the SonicWall devices and probably 80 GFI ME/MS and they really don't compare. You can go with outsourced solutions, but the truth is that people will never log in and check their spam.
Ever feel like you are driving the getaway car?
Charged with WHAT TASK? Manually sift through the entire company's spam folder?
Somebody, please tell me this is not a regular thing at U.S. companies. It's not, right? It's not, no, it's not? It just can't be, no? You can't just tell a human being to read all junk mail for fifty people, 'cause it's inhuman, right? Right?
(a European A.C. about to move to the Americas)
I've had excellent results with this particular product. Spamd uses blacklisting, greylisting, and tarpitting. It really is delightfully evil and still makes me smile because it includes a fake smtp daemon which sets the tcp rcv window to 1. This is a kick in the nuts to the spammer. I've used it with resounding success at a client who was recieving 2000 spam emails a day. Prior to implementing spamd, we were using just a Barracuda. When I combined spamd and the Barracuda, spamd caught about 1975 of the spam messages and the barracuda took over from there. No false positives and we've been running for three months. This link details how to set it up, http://www.linux.com/feature/61103.
I work for a company with about 500 users on the network for email purposes and we use Trend Micro IMSS (InterScan Messaging Security Suite)7.0 for Linux. (They offer a windows solution for IMSS but we prefer the Linux solution) This is basically a linux box (RHEL 4.0/CENTOS 4.0) with postfix as an MTA and the postfix server is used as an email gateway for our Microsoft Exchange server. This system catches about up to 10,000 spam a day with a miss rate for less than 1 % (I track these numbers every day). In the month of April we caught about 267,000 spam for the month. The reason why we don't use the windows version of IMSS is while running version 5.7 of the linux version we had an attack that would have allowed a hacker to gain admin rights on the box had it have been a windows box. We were considering changing to a windows version of IMSS (I have one co-worker who is VERY windows centric and just doesn't understand linux at all!) at that time but that one attack sold us on the linux version of IMSS. I have no idea what this all cost, I don't get involved in that side of the business but as a solution it is great! I'm sure you could also build a CENTOS 4.0 with Postfix and spamassassin with the same effect. Much good luck.
I wouldn't bother with most commercial systems, and greylisting is only part of the solution. What I have done multiple places (and always been happy with) is to have an offsite mail filter / mail backup such as no-ip.com(I happen to use them, anybody with similar service is fine should be no more than around $50/year). They do some basic filtering. then send the mail on to you. At that point I use maia mailguard ( http://www.maiamailguard.com/maia/wiki ), it's essentially a frontend to spamassassin(which is what most commercial appliances use) that gives each user the ability to set their own spam threshold as well as how often they get notifications of spam. It provides per user statisitics as well.
For example, at work I have my spam threshold set to 2, while the suppport mailbox is 10. so I get very little spam, but the occasional email is blocked, while support email always goes through, but we get a bit of spam.
We run a mid sized hosting company and we need a way to filter the spam complaints out to our customers. The problem is that every spam database sends a different kind of email with different information, most include the mail server IP but some don't. Is there any solution available for that?
IMHO, in the long run a subscription based anti-spam solution is the only way to go. Spam is mutating every day and having to keep up with it yourself is an exhausting task. So you'll have to treat the spam problem as you do with viruses: purchase a subscription product that is updated daily.
We're using Astaro Mail Security (www.astaro.com), which works great. Spam is down to a minimum, and it delivers much better results than open source solution I had in place before that.
FYI: I receive about 300 spam messages a day and only once in a few days one or two messages slip through with the solution mentioned above.
But please note that there are a lot of different anti-spam vendors, all with their own advantages/disadvantages, price tag and quality.
In my personal experience, while I'm a big fan of open source, open source anti-spam solutions require too much configuration and maintenance to really be practical in the long run. But your mileage may vary depending on the requirements your company sets forth.
I've been running this for quite some time with fantastic results. It's a VMWare appliance.
Inside, there is greylisting and MailScanner. Within MailScanner, there is SpamAssassin, some RBL, ClamAV and all sorts of things.
For my organization, I find that in addition to everything else "stock" I can safely filter out all countries but the U.S. since we don't do business outside of our state, let alone our country... so it's safe to assume that anything from outside the US will be spam.
It is extremely effective. I have helped to get the VM set up in environments with multiple domains and it works very well too.
One problem with it is that it is rapidly aging. The user community has made some effort to get the VM up to date in some ways, but the 2.0 version as far as anyone can tell is still in discussion and planning. The project creator and leader is a one-man-show and he seems to have a life outside of this project for some reason. The user community is frantic to get something to replace the aging 1.7.1.5 machine we all use as the reference point for our installs.
Subject says it all, really. The best approach is to set up an OpenBSD machine as your gateway, filter traffic using PF to any degree you desire, and please set up spamd in greylisting mode (the default).
That will take care of most of your spam right there, and you could usefully have something like a spamasassin and clamav combo running in the delivery phase on your real mail server.
Useful references: Firewalling with OpenBSD's PF (tutorial)
The Book of PF
and Effective spam and malware countermeasures: Network noise reduction using free tools
And yes, I've blogged a bit about this too, over at my blog
-- That grumpy BSD guy - http://bsdly.blogspot.com/
Meanwhile, here is some general guidance. First, do not waste your money on commercial products -- they're expensive, poorly-maintained, and in many cases (e.g. Barracuda) actually make the spam problem worse via backscatter. (There are now several thousand Barracudas on a communally-maintained blacklist, making it obvious to everyone working in this field that Barracuda is completely incompetent.) Second, do invest your money and time in open-source solutions: it is easy for anyone who possesses baseline competence in mail to craft their own, superior spam handling system using postfix or sendmail or another open-source MTA, DNSBLs, RHSBLs, judicious configuration, and other tools such as rbldnsd, mimedefang, SpamAssassin, ClamAV, and so on. Third, a little googling will reveal near-cookbook procedures for combining these pieces of software together into a useful system; which cookbook procedure is appropriate for you depends on your environment -- which brings me to the fourth point, which is that you need to perform log analysis in order to understand your particular mix of spam/not-spam. Everyone's is different, which is why one-size-fits-all solutions usually fail. Only after you have some clue about the size and shape of your problem will you be able to determine which approach(es) are likely to minimize both false negatives (FN) and false positives (FP).
As an aside, one set of highly effective anti-spam tactics involves enforcing RFC requirements that have been in place for many years: for example, all mail servers must have rDNS; that rDNS must resolve to a host which in turn resolves back to the IP; the domain of the host must exist; the host must HELO as a valid FQDN or bracketed-quad IP; the envelope-sender's domain must exist; the host must not HELO as you; the host must wait for the SMTP greeting before HELO'ing; the host must handle a multi-line SMTP greeting; the MX records for the host must point to valid IP space; and so on. Enforcement of these requirements yields differing rates of spam control (which is again why log analysis is crucial) but has the very valuable property that it can be done at low computational and bandwidth cost. Substantial experience with these suggests that enabling them and augmenting them with a few DNSBLs (especially the Spamhaus Zen zone) is enough to deal with the overwhelming majority of the spam problem at most sites, reducing what's left to a much smaller issue to be dealt with.
dnsbl/enhdnsbl is enabled for zen.spamhaus.org, bl.spamcop.net, combined.njabl.org, list.dsbl.org, dnsbl-1.uceprotect.net, dnsbl-2.uceprotect.net, dnsbl-3.uceprotect.net and sbl-xbl.spamhaus.org. With all these enabled there are very few spam messages falling through.
Adding to this I am using Mozilla Thunderbird which has a very good intelligent junk mail filter. The only disadvantage is that the junk mail filter has to learn what's junk or not.
The use of dnsbl/enhdnsbl also does bounce back to the sender with a reasonable message for the cases where a message is denied so the sender shall be informed about any messages that are denied. Of course - it isn't fool-proof, but it works for me.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The best service I ever subscribed for: $3/user/year. As a non-profit, my company got another 50% discount.
http://www.google.com/a/help/intl/en/security/compare.html#utm_campaign=en&utm_source=en-ha-na-us-bk&utm_medium=ha&utm_term=google%20message%20filtering
This came from Google's Postini acquisition.
For this service, you change your MX record to Google's filtering server and set your mail server to only receive incoming SMTP traffic from Google. Google's email filtering for spam and virus is real-time. Google do not retain your email so your privacy is assured. I was able to cut down 80% of traffic from my SMTP server.
You could try a dynamic bayesian filter system like Bogofilter or Dpsam. If the internal staff use IMAP then create a couple of training folders and let the end users train up their own filter database by dragging ham or spam from their Inbox and Spam folders to the appropriate retraining folder. A bash script on a 5 minute cron job can do the retraining, which is effectively instant retraining. Bogofilter on it's own in tri-mode (ham, spam, unsure) works great without even thinking about Spamassassin. I use Dspam now and get about 1 spam per day in my Inbox out of 100 to 200 spams in my Spam folder. It takes me 5 seconds to drag it into the retraining folder, ie; no effort at all. All spam is kept in the Spam.Unsure folder for 24 hours but that could easily be for a week, or more, so nothing is actually immediately deleted. If the end-user checks their Spam.Unsure and Spam folder every now and then for false positives then you don't have to do anything. Woops, maybe you need the job... hang on, leave things the way they are and keep your job.
I've found filtering on sender IP to be very effective. Greylist IP's that don't match sender domain name, blacklist all unknown sender IP's and all dynamically assigned IP's. (Real companies don't use an ADSL or cable dynamic IP address). My latest tweak (and I'm not excited about adding it) is to do a check of the nameserver for the domain. If it is domaincontrol.com, I dump it. I guess the spammer's have figured out some of the registrar's will collude with the spammers for the 10 bucks per domain. After all that, I get 5 spam's per week(max) and have not had complaints of bounced mail. Because it is not examining content, it is very fast as well.
I don't work for them, but I sing their praises. http://www.spamstopshere.com/ Tell them Scott Clark sent you. Good Karma.
To control spam, I now allow incoming messages only from senders I have approved beforehand.
If you would like to be added to my list of approved senders, please fill out the short request form (see link below). Once I approve you, I will receive your original message in my inbox. You do not need to resend your message. I apologize for this one-time inconvenience.
Click the link below to fill out the request:
https://webmail.atl.earthlink.net/wam/addme?a=%5BEMAILHERE%5D&id=%5BIDNUMHERE%5D Does anyone have experience with this?
Be sure your setup does all the checks at while the SMTP connection is open, so you can avoid backscatter. I use greylisting to help avoid false positives. I also use callbacks to verify the authenticity of the sender. I'd recommend caution here, because this can really cause false positives.
Be sure to have good HELO filtering rules, as that will detect a surprising majority of spam and viruses, as well as misconfigured exchange servers that don't use a FQDN in the HELO line.
We've been using PureMessage for Unix for about 3 years, but most likely won't be next year when it's time to renew.
/var/log/maillog to make sure nothing is being rejected that shouldn't be.
We use a dedicated postfix server (that comes with PureMessage). Each message is sent to PureMessage via "content_filter=". After the message has been tagged as spam, it's sent back to postfix with the subject line tagged with "[SPAM:####" (the number of #'s are an indication to the messages spam level). Then the message is relayed to our Exchange server.
Yesterday afternoon I was working on configuring the postfix system to perform message checks to get rid backscatter http://en.wikipedia.org/wiki/Backscatter_(e-mail)
While searching for ways to have postfix do this I ran across some basic spam fighting tips. Before I implemented the below postix additions, I myself was recieving on average 5 messages an hour tagged with [SPAM:####]. Not one single spam message has hit my inbox since yesterday, and I've been watching
#main.cf
smtpd_recipient_restrictions =
reject_invalid_hostname,
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
permit_mynetworks,
reject_unauth_destination,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client list.dsbl.org,
reject_rbl_client zen.spamhaus.org,
permit
So far everything that has been blocked is due to the sending server being listed on those RBL lists. RBL checks can be easily added to other MTAs if you're not using Postfix.
Of course I'll be monitoring the situation closely for awhile to make sure nothing is being rejected that shouldn't be, but if this sort of configuration can save you from looking at hundreds of messages a day, it might be worth a look.
Dan
Use whatever you want for your internal mail server, but use sendmail with miltering for your internet facing relays.
With sendmail, use mimedefang, spamassassin, and milter-greylist (actually that last can be implemented yourself in mimedefang, I just never had the time).
The nice thing about this solution is that it does not require you to pay some third party a huge amount of money each month, while doing exactly what they do (actually better), and it is fully customizable to fit into your environment (want to do a virus quarantine? Custom rules per employee? do interesting things based on different domains?). You can really get to pretty much 0 false positives while removing all of the cruft with this solution.
In sendmail configuration, use greet pause, bad receipt throttling, and all of the privacy flags.
For your mimedefang filter, add rejects for these things:
- relay is in the spamhaus zen list or dsbl.org blacklist
- helo of sending relay is not FQDN or IP Address
- sender claims to be from your domain
- relay's helo claims to be a system on your domain
- relay's helo is RFC1918 address
For your spamassassin (which now that you are rejecting obvious stupidity, won't be called as often, saving CPU and Disk cycles on your relays!) use automatic SARE rules.
Train your help desk on basic mail troubleshooting (greylisting can be troublesome at first) so that they can help with the trivial stuff rather than call your mail admins all of the time. Give them an interface to see what is going on in the logs.
I can't imagine having one centralized person manually inspecting everyone's junk-mail header is the optimal solution
Actually, that strikes me as a good solution; it's certainly better than having other employees dealing with spam as part of their daily routine and losing 30 minutes/day for everybody in the company. And by centralizing it, you have the ability to pick the tools to make your work more efficient, as opposed to having 50 employees each fiddle with their own spam filters.
I've found ASSP to be very effective in our organization of 150 mailboxes. Supports Greylisting, Bayesian filtering, SPF, RBL, REGEX, and more...It is a two-way filter, so recipients of mail sent from your organization will be whitelisted for a period of time, and SPAM is stopped at the SMTP level (resulting in a SMTP failure), so no messages should be lost...end users can submit spam messages by simply forwarding them to a specific address (e.g. asspspam@domain). All spam can also be sent to a specific email address for easy retrieval of false positives (although after the Bayesian filter is trained properly, there is VERY little), in addition, all legit messages can be cc'd to another email address, which we use for email archiving (maildir is tar.gz'd weekly)
This has to be an utter fake. 50 employees and you're hand-tagging the spam? I'd say it's possible you've never heard of spamassassin, but this is SLASHDOT for fucks' sake.
If you have the technical ability to roll your own, I HIGHLY recommend a SpamAssassin solution. We run SpamAssassin/Amavis/ClamAV running on OpenSUSE 10.3 and Maia Mailguard for quarantine management. It is VERY effective at stopping spam.
I run a small business who primary source of income is web development and we were recently approached by MXLogic to be a partner. We tried out the service first before offering it to our current and future customers and it is the best solution I have encountered and glad we can offer it as a solution to our customers. MXLogic works by directing your e-mail through their servers first so your servers don't have to do the extra work. You actually get a better deal working through a partner and directly through MXLogic. I don't want to give a direct link because I don't think comments should be used to advertise but you can contact me via my profile to learn more. I think it was eWeek or Information Week or similar magazine rated it the top solution.
Have you considered migrating to GMail for your domain? That way, Google does the SPAM filtering for you.
In addition, you get an excellent webmailer and additional apps, if you want.
Comment removed based on user account deletion
You're going to get a ton of different advice. A lot of it will be total crap. A lot of it will be valid. It is going to be hard to know the difference.
Personally, like many folks, I've been battling spam for years, and have used a lot of different solutions: DSPAM, SpamAssassin (SA), and a lot of other random tools. DSPAM and SA both worked reasonably well for me, but many of my users, for one reason or another, had troubles with them. I'm sure I could have put effort into making either of them work better, but frankly, a fair amount of labor had already gone into them, and I didn't want to invest more. About a year ago, I decided to try Kaspersky Anti-Spam[1], and have been very, very happy with the results. It was a simple install, there aren't too many options, and it seems to "just work".
Professionally, I have administered some very large mail service provider systems. The largest of them used a pool of Proofpoint[2] PPS servers to filter mail. While I am not sure it was the best product for what we were doing, it was an impressive product, and if I were handling mail for a business of any size, I would seriously consider this product. It is highly configurable and the results were solid.
Good luck,
robert
[1] http://usa.kaspersky.com/products_services/anti-spam3.php
[2] http://www.proofpoint.com/products/pps.php
This is just a simple guide compiled from my experience:
:)
1. Do what you can on the server. I like to use SpamAssassin to add spam scores to beginning of subject lines, so they sort by score in my inbox (I use "/*_SCORE(0)_*/"). I also automatically delete anything over a score of 11, since the highest I've ever seen a legitimate email score has been "10.something". Realistically, anything above an 8 is the sender's fault and they need to do something about it and anything above an 11 you can safely blame the sender (you won't be the only spam filter deleting their emails).
2. Provide the tools on the client. ThunderBird's "spam marker" is a must, and because it learns from what you mark, you aren't just marking them in vain. Also, to deal with spam in real-time, instead of using the junk folder, I like using the "delete junk!" button from the "Buttons!" add-on. Incoming junk gets marked and marked as read, and after marking the spam the filter missed, I hit "delete junk". Very easy and quick. Pre-configure Thunderbird for everyone.
3. Educate and support. If you have 1 and 2 in place, then make sure everyone knows what you are doing and why you chose to do it. Write a short manual or something. Educate them about their tools. They also need to know NOT to publish their addresses.
The idea is to make spam highly visible, and to make it *quick and easy* to deal with. Knowing you've facilitated these two goals should be enough to impress your employer and earn the respect you deserve from everyone you serve
I spent a few days migrating 100,000 emails from Windows Mail, because it was horrible. Thunderbird is a godsend and the add-ons make all the difference. If there is something you dislike or want, chances are someone made an add-on for it.
btw 2000 messages is *not* a lot of spam. It will get far worse with time.
I suspect your allready paying for backup email servers. Why not expand this with spam/anti virus. By using smarthost servers. Shoudn't cost too much.
http://en.wikipedia.org/wiki/Smarthost
Often ISP have very expensive equipment todo the job perfectly wich you could never buy yourself.
And another + is that they will prolly be better suited to 0 day attacks and your e-mail server isn't publicly known by the word (hence its not mentioned in the MX records).
But get informed of what solution they are using so you make the right choice for your organisation.
If you accept a spam message (i.e. if you don't reject it before the SMTP dialog is finished), you've made it your problem and the rest is only a matter of finding the person whose time is the least expensive to take care of it.
Dealing with spam means rejecting it as early as possible. You can't "bounce" after accepting mail. Bouncing mail after the fact would only create backscatter and the people whose addresses have been forged in the header will not take that lightly.
Once the mail has been accepted, it is your responsibility. Mistakenly deleting it may cause a liability for your company. That's another reason for identifying spam before it is accepted by the border SMTP server.
Rejecting mail at the border server will provide a notification to legitimate senders, who can then try and contact you in a different way or work with you to correct whatever causes the misclassification.
Comment removed based on user account deletion
This company allows you to outsource spam filtering. The founder is a well-known OS developer, so it may be worth a try.
Barracuda costs about $800.00 US. They do a great job, and you can delegate the releasing or deleting to your users. It has a decent web interface, and with a little training, you can go on to other more important things.
"My immediate reaction is "WTF? What kind of moron doesn't make things 64-bit safe to begin with?" Linus
http://www.mailwatch.com/
It's cheap and it's extremely effective. I've been using them for our small business for over 5 years now. Enjoy!
"Keep at least 3-6 full bottles of hard alcohol on hand, a 2 week resignation notice,..." - Poetmatt
We use both MessageLabs and Google Apps for different domains.
Personally, I find the two pretty comparable in terms of spam filtering (Google lets less through, but has the odd false-positive, in MessageLabs' case, I-as an end-user-don't even SEE potential false-positives, which means ultimately I prefer Google).
PS. When is Slashdot going to fix UTF-8 handling of this poxy in-line comment box? Why can't I use â(TM) (apostrophe) or â" (em-dash)?
For an open source solution, I recommend Untangle.
The best open source projects, integrated and made easier for spam blocking, web filtering, remote access and more
* Commercial-grade open source alternative to SonicWALL and WatchGuard
* 14 integrated apps - use one or all of them
* Runs on off-the-shelf hardware
Site: http://www.untangle.com/
i use what was formerally called frontbridge. now called microsoft exchange hosted services. it is a very accurate system that you can use to just scan incoming messages, and send them on to your mail server. very little config to worry about and very acurate. it isnt terribly expensive either.
www.frontbridge.com
If you want to outsource the entire problem, try a service like Sprint's "SEPS", which costs $250/month, and works very well. 97% of e-mail to our domain is spam, and SEPS handles it correctly to at least 4 9's. All admin is via web browser and, although it's sometimes slow, it's pretty straightforward. Set up a reject list, put your valid users on it, and save SPAM for a day or so, just in case. Then, you simply point your DNS for incoming mail to SEPS IP address, and collect your mail internally from their mail server instead of yours. A side advantage is that, if your MTA goes down, or you lose Internet service, etc., SEPS queues the mail up for you, and delivers it when you come back online. If you can spend $3000 a year, it's one less headache and worth the cost, IMHO. http://www.sprint.com/business/products/products/spamFiltering_tabA.html or thereabouts, to get started.
I've got so much backscatter from ill-configured Barracudas that I suspect them to have some really sick defaults.
To me, Barracuda has become more a synonymous of spam. Sigh.
In a small business wanting to not devote a lot of time to this issue, we are using nospamtoday. There isn't anything perfect, and it isn't either, but it does a good job, is fairly priced, and is server side. Basically it is a front-end for spamassassin, with some RBLs and other measures used as well. Yeah, you could install spamassassin for free, but this gives you an easy installer and at least someone to e-mail if you have issues. And it is a one time fee, as there are no monthly or yearly subscription fees!
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
I've seen a lot of good responses here, covering several different strategies, attitudes/perspectives, and of course, our favorite products. Let me add another dimension: user education.
1. Create an FAQ that covers all the big boogie monsters in spam: false positives, false negatives, spam backscatter, MAIL FROMs are 100% forgeable and offer no guarantee of identity, outright blocking by rarely works anymore, and above all, no spam system -anywhere- is perfect.
2. Provide your users with a meaningful way to report false positives and negatives. You don't have to provide guarantees, just let them know that they're being heard.
3. This is the most important one: Show them the statistics. If you're blocking 2,000 a day, illustrate! This can be particularly dramatic in a large organization like mine, where 95% of SMTP connections/messages get dropped. A nice little bar graph puts little miss bitchy-face's 1-2 spams per day in stark perspective.
Spam sucks the big one, boy howdy. Cheers!
The best solution currently in the marketplace, *BY FAR* is CloudMark. http://www.cloudmark.com/
They have a desktop and a server version and charge per user. I think we pay about $1000usd per year for 50 users. They catch everything except the occasional backscatter Non deliverable report from when your address is joejobbed.
The way it works is they generate various hashes from message content and aggregate those in their central DB.
Mail (from what I remember) is never blocked until a sufficient number users, who are weighted differently based on trust (reporting history), mark it as spam.
This doesn't cause any delay as they have zillions of users, and I believe most of the reporting comes from users of their desktop versions. I don't believe I have *ever* had a false positive, as in zero in 2 years of use.
Can't recommend them highly enough. Software used to be a little crappy and would hang sometimes (runs as a service hooking to exchange...or maybe it's mapi), but they've fixed that earlier this year.
Any questions let me know
.sig
We catch about 12,000 spam emails daily for our customers using just spamassassin, it took a bit of setting up but works fine and it's as accurate as my gmail account
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
I have made a virtual appliance I deploy to my customers, mainly in the 10-100 employee range.
It has Ubuntu server LTS-release, postfix, amavisd-new, postfix-policy-dæmon, clamav and spamassassin. It works really great, and I have have Postfix insert Exchange-compatible headers so that the users can use the features included in Outlook/Exchange.
Fully integrated, no quarantine management (other than the 'junk'-folder) and from what I can tell: no false positives and extremely low rate for false negatives (my guesstimate is less than 0,5%).
And all I need is a server present with some free RAM!
Automatic updates of all the components and automatic bayes learning means the system is self-supporting aswell.
I'm listed as the technical support contact for my employer's listings on eBay, and our PayPal account links to me as well. No spam filter on God's green earth is going to cull the spam from the ham for me.
I manage self-hosted email for several small-medium companies. ASSP is platform independent, low resource, and does a VERY good job. VERY very configurable, and free, open source, easy to modify, easy upkeep (almost zero action required beyond checking the logs to keep an eye on things) and free software.
In a company of about 75 email accounts it has blocked 4 million spams in a little over a year.
The false negative rate is so low it might as well be zero, and the false positive rate as well.
It uses among many other things whitelists,so your people never miss an email from an established contact, redlists, so a known spammer cannot ever be accidentally added to the whitelist, does spf checking, checks headers against spoofing, has an antivirus component, can forward a copy of all spam to a spamlover address and much much more.
and its free.
For a single sbs server, you can install it on the same box and zero out of pocket costs except for your time to install it (I would personally budget 20 hours for R&D for a first time administrator to install it).
Please email me if you want more detailed information on how it works for my clients. I can also put you in contact with end users at the executive level of these companies to ask how they like it (the final litmus test)
Good luck
Chuck
We have about 5000 users and recieve about 1,200,000 emails a day of which all but about 100,000 are spam. We use IceWarp's mail server which is very heavy in antispam features that you can configure and fine tune. I've found what works best is to have it automatically whitelist anyone our users send email to and then really crankup the spam filtering. If someone talks to a business prospect, they ask if they can send the prospect contact information. If so, that person is now whitelisted and we will receive email from them unmolested. We also have one email address with light antispam filtering (catches about 70% with no false positives) for unsolicited inquires.
Want a hands-off solution with zero configuration? gMail. Switch everyone to google's company tools.
Yeah yeah switching a company to gMail is a ridiculous suggestion, you can't store company information remotely, users will panic at the change, fire will break out in the streets and cats and dogs will run together.
But all that aside, if you can look at the suggestion without all the doomsday scenarios in mind, gMail offers completely autonomous service-free zero-configuration spam-filtering. Which is about as easy as spam-filtering can get, I think.
http://www.google.com/a/help/intl/en/security/compare.html
Thats what I did back in september 06 when I joined the company I manage IT for now, they had an aging win2k exchange server which I threw down the stairs - set them up with google apps for small biz and let gmail content filter for them.
They get all the benefits of gmail, with their own domain.
I've tried dozens of solutions for ridding my small company of spam, and nothing worked - that is until I dumped Exchange server and signed up to have Google's Gmail admin all the email accounts. (http://www.google.com/a/help/intl/en/var_2.html) I was wary of using Google for something as mission critical as my company's email, and tried it out of desperation. I've used my domain/email address since 1995 or so, and even though I'd been pretty careful with it (not using it on newsgroups, mailing lists, etc.) we were still logging at least 100 spam messages per day - and that was AFTER the anti-spam filters had a crack at the inbox. The cool thing about Gmail's approach is that I can still get to my email from anywhere (as with Exchange Server) but it's now virtually spam-free. I've gone from at least 100 spam messages per day that got around my filters to MAYBE one or two per week. Same email address - but now almost entirely spam free. For companies of 50 or smaller, the Gmail-hosted domain solution is free. (For larger domains, they charge a fee - but it's fairly reasonable.) If you can live without Exchange Server (and it's evil twin, Outlook), it's worth a look.
Captain Digital fighting for truth, justice, and really cool motion graphics.
I was faced with exactly this problem myself around October/November last year.
You've basically got three options:
1. Go for a completely outsourced service.
Pros: It's someone else's problem to look after.
Cons: A company of 50 staff will never be terribly important to such a service provider. Unless they provide an extremely good control panel and logs, sooner or later someone's going to ask where an email is and your answer is going to be "er... let me get back to you on that.... er... I don't know".
2. Go for an appliance - either in the form of a prebuilt lump of tin like the Barracuda system mentioned elsewhere or in the form of a precooked Linux installation which is literally just a matter of "insert CD, boot, tell it what it's IP address is and what domain it's providing email for".
Pros: Dead easy to set up. Most also provide a nice web-based UI.
Cons: The decent ones are almost universally commercial and you have to pay licensing fees on a per-active-email-address basis, which can get very expensive - particularly when the vendor won't tell you how their system decides how many email addresses are regularly active and the first you know that you're exceeding the license is when suddenly all the spam filtering is disabled.
If you look closely, expect to find that many of them are architected around a number of single points of failure. And in the real world, nobody is likely to check a web-based UI on the offchance that they find an email misclassified as spam sat there.
3. Roll your own. If you take this route, I can strongly recommend rolling it around an existing framework rather than following a bunch of complicated instructions to configure Postfix that you have to re-learn every time anything needs tweaking. This is the route I took, and I based it around MailScanner. MailScanner provides a framework for plugging in spam and virus filters and allows you to divide spam according to its score. Delete high scoring spam, let low scoring spam through with a note in the subject line that it's suspected spam and let non-spam straight through.
Pros: You get to keep a close eye on all the configuration, can keep close track of the logs and respond quickly to any issues. Your users can easily set up filters for spam (for that matter, so can you) and their "potential-spam" where misclassified mail may wind up is in their email client rather than a separate web-based system.
Cons: You need to become intimately familiar with every aspect of your email system in order to manage it effectively. I would argue that any self-respecting sysadmin should be intimately familiar with his email system anyway, but YMMV.
We have slightly more people in our office - approx. 65. We used GFI for a while - it sucked to administer and use, it just isn't good enough. While not inexpensive, I have been very pleased with the IronPort C series device. Very pleased. Even thought they were purchased by Cisco, they still operate independently. Their support (that I've used twice in 3 years) is also very good. I manage mine like yours - I manually review the stuff that gets quarantined - maybe 15 a day all of the rest of the "definite" spam gets bounced. We've only had about 3 false positives in 3 years.
I was in the same situation and found that I just didn't have the time to deal with it effectively. We crossed paths with the folks at mxlogic and they convinced us to give their service a try. They have a small army of people maintaining a defense against spam. It's worked out great for us and only costs about 50 bucks a year. There's no way you can beat that unless you don't really have anything else to do.
Ack, I would rather a one-time cost than an ongoing one like that...
TRy ASSP, works great.
Chuck
Several clients use it - and there's next to no work on your side.
www.mxlogic.com
At home with a private domain-name, I forward all my email to gmail, let gmail do the job of filtering, and download it after that. (1300 spam messages in 2 days) After that I redistrubute the mail to my family-members. At the office we have a provider who checks our mail for spam, so there is a spambox centralised at our provider. ( > 3000 a week) This is also our fallback, just in case our company email fails. At the office we have a dmz and a server with trend micro, which filters spam. Also a large quarantaine area with quarantained emails. Even then there is spam reaching the users. In the local network of our office is an exchange server. The users are working with outlook and have the opportunity to make filter-rules for spam. When users know for sure there is an email sended and it has not reached their email-box, we can connect to the quarantaine-area in the dmz, search for the email and release it to the user. So the positive effect of all these things is, that I can use my time for orther things. (games and so on...)
Your can use mail avenger. It rejects span in the smtp chat, so no reject notificacion need to be made. MailAvenger filters by compliyng the rfc strictly so if any "non spam" mail is rejected is not your fault, Is because has been sent out of the SMTP protocol.
Sorry, but now that I have been using Google Apps for email, if you have up to several hundred people, you are just plain nuts to do your own email.
.... no more, no way.
Why would you even want to?
Do not discount what Google Aps does before you try it.
I used to have my own email servers,
* Carthago Delenda Est *
Use the sendmail Milter. If the email gets bounced the sender is told and THAT way important emails can be resent.
Are you freaking serious? You're manually inspecting messages tagged as spam looking for legitimate messages? Do you have to wipe people's asses for them too?
Most companies who have effectively dealt with the spam solution have implemented a product that can do filtering based on multiple criteria, and they don't worry about sifting through what was caught by the filters. There are many, many good products out there, but one of my favorites is called XWall. You can get it from www.dataenter.au. The thing that I like best about XWall is that it is inexpensive (less than $500 per SMTP gateway) and that it has a TON of criteria that you can use. Of course you can have it query various blacklisting services, that's pretty much standard. One thing that it supports that I found was highly effective was greylisting. Then there are a number of other criteria including using bayesian filtering, setting up whitelisting, etc. In most cases where I have deployed it I've just set up greylisting along with a couple of common blacklists (Spamhaus and one that lists servers in dynamic IP ranges, which are usally broadband connected zombies), and the reduction in spam is so dramatic that most people are satisfied. After running it for a few years I finally got around to tuning the Bayesian filtering enough to turn it on. You just set the spam detection threshold pretty high initially, then gradually lower it as the system is tuned for the user base. If you have critical clients/business partners, you just whitelist their domain from the beginning.
If you don't want to just drop messages that are flagged as spam, you can have your application prepend the subject line with "SAPM:" and then set up a client-side rule to sort those messages into a spam folder. That way if the user thinks that the filter is overzealous they can check their own spam messages for legitimate content. This also helps when initially tuning the anti-spam system, but it does end up eating up tons of email storage if you support a large number of users.
Every once in awhile we'd have an issue where something important got tagged as spam, or it took longer than expected to get a message delivered due to greylisting, but those things are usually pretty easy to fix. If anyone complained about "time sensitive" emails not getting delivered in time, I'd usually tell them not to use email for something time critical. After all, email isn't a real-time application, mail delivery is handled on a best-effort basis, and while messages usually are delivered within a minute or two there are sorts of things that I have no control over that can cause delays in delivery.
Very intuitive to setup and stops 95% of the spam. Has a nice web interface for your users to whitelist/blacklist addresses and to release messages stuck in the filter. I think you can get a 30 day trial to check it out, but you will have to deal with the salespeople. www.marshal.com
We have about 4000 employees.
A few years back, we implemented Sprint Spam Assassain service. It was one of the best decisions we made--very turnkey, no maintenence and has nice fringe benefits like still being up to collect mail when your mail server goes tits up.
I would definitely look for a hosted, outsourced option rather than have to worry about anything yourself.
I work for a small hosting company, and we found that a combination of Postini, along with SpamAssassin works very well
They use me!
More seriously there are many approaches that you can take, from the DNS-blased blacklists, bayasian filtering at SMTP time, and then any local content-filtering rules.
Spam is constantly evolving though, so you might find it more productive to just outsource it as others have suggested. (I couldn't recommend gmail though!)
Companies such MessageLabs, etc, exist and do a good job. There is even my own service which uses a nice configurable combination of DNS blacklists, bayasian filtering, valid user detection and more - the advantage to my service/system is that each rejected message is quarantined for a month so you can easily catch false positives.
I'm messaging engineer for one of the top 20 companies in the Fortune 500.
276 million emails in a month
271 million of those blocked and dropped (no NDR, SMTP rejects with 500 code) (roughly 98%+ dropped before reaching the end users.
No end user quarantine or notification to end user. WE don't have to worry about 'educating' the users about spam and all the resultant training, end user support and burden on our IT help desk.
Ironport is accurate enough that we don't have to worry about reviewing what's blocked.
3+ years running it.
Mind you, Ironport likes large corporate customers, but they also had small under (the c10 or C100 when when bought our other ones... and I think Dell does, or did, sell the C10/C100 under the Dell label as well. They are reasonably priced, particularly if you consider the accuracy and the lack of having to train endusers about spam.
www.ironport.com
My firm utilizes MXLogic. MX records redirect all mail to them for 40-odd spam tests. Only non-quarantined mail is then delivered to users (we find that the load on mail servers reduces by 60%). The real advantage is that users all receive a quarantine report in their inboxes daily. This allows them to release (white-list) items quarantined. Because 1 man's spam is another's ham, this "grassroots" approach seems to work best. Aside from a few global white-listings (business partners) and black-listings (mischevious ex-employees), there is very little top-down administration. Also, there is nothing to install or maintain on workstations like with SpamBayes or other client-based filters. The cost per user is very resaonable, especially when you consider the time it will save admins.
I have the same duties at a similarly sized company. First of all, your users are to be congratulated for good internet practices that result in only 2000 SPAM emails a day. Typically, our filters capture about 40,000 SPAM per day. We use three layers of filtering. Our first defense is a commercial real time black list service. Email from an IP address on the black list results in a rejection with a 500 error. This blocks about 65% of our incoming SPAM. Email that makes it through the RBL gets processed by Spam Assassin which tags suspected SPAM but lets it pass through to the next stage. The third stage is another SPAM filter contained in the mail server anti-virus scanner. This also just marks suspected SPAM. I have set up rules on our local user's machines to dump any emails marked SPAM into a SPAM folder on their machines. It is the user's responsibility to periodically screen the SPAM folder for false positives, and yes, I still get occasional complaints from users.
Since we are part of a larger umbrella corporation, we've been using a product called MX Logic. Basically, MX Logic is a service provider intercepts all of our email and scans it for viruses and spam. Our MX records point to their servers. Our Email Server then accepts only email from their server farms. This does a couple of things:
1. The email doesn't touch our email server until it's been scanned.
2. If the email is dubious, the user gets an email allowing them to accept or deny the email from them (No work on my part).
3. It hides our email server from any would be spammers since MX Logic is the interceptor.
While this does cost a little bit of money, it's worked extremely well and since it's a Service Provider, we don't pay for any hardware or maintenance costs. We just pay a yearly fee per user. Once the email hits our server, it is then scanned again for viruses and then passed on to the user. We've had a lot of success with this product. Of course, the OSS solutions are great too (I use those at home), but for our needs, MX Logic has done a great job.
Barracuda uses Spamassassin with many layers. I built myself a Spamassassin filter and added many layers. There are few false positives and some people went from 200 spam messages a day, to 10 a day. I called about a Barracuda system and asked the m about customizing their filters and they said it wasn't possible. So.. why pay $6,000 when I can do it myself and it only costs my company, the time for me to do it? Barracuda is a rip off. Read all about Spamassassin and build yourself one damn good filter with many layers and it's going to be just as good, if not better than Barracuda.
MX Logic filters before your mail server downloads the spam. Don't clog your pipes with garbage. There is excellent user access to blocked mail.
When I was young, I had to rub sticks together to compute.
We've moved all of our clients to external spam filters (specifically Messagelabs). We *MIGHT* get 1 false positive (across 500 mailboxes) a month. The users have direct access to their quarantines as well, so they can do a double-check.
.. like Exchange Defender. I don't know the quality of them though.
There's one other really important bonus to external filters - if your server ever goes down, mail queues on their side. That alone is worth the price of admission.
There are cheaper filters than Messagelabs too
We're using an Exchange 2007 Edge Server, with ForeFront Security for Exchange and it's integrated Spamfilter.
Works well. Spam is tagged and automatically sorted to the users Junk-Mail folder, directly accessible within Outlook. Each user checks their Junkmail folder on their own.
There's no maintenance involved.
(We're around 35 People).
I'm using spamassassin + exim on mail relay gateways of a 2000+ email installation. It works great.
You need to add the dccproc ( http://www.rhyolite.com/anti-spam/dcc/dcc-tree/dccproc.html ) and razor ( http://en.wikipedia.org/wiki/Vipul's_Razor ) plugins in order to use those "reputation" services, turn on bayes filtering, wait for 200 messages to be "marked" and there you go. If you have enough load, you might need to switch from the DB database backend to mysql. One thing you might be interested in is http://www.untangle.com/ ... looks interesting.
I had a similar experience several years ago: No matter how you tweak the filters, it's wrong - catch 22.
;-)
Besides, spending several hours a day releasing mails from quarantine is not really an enjoyable or satisfying task.
So, here's what I did: We're also using GFI, so you can as well keep it. Maybe it's not the best system around, but I currently use a combination of postfix and RBLs on the perimeter and GFI Mail-Security and -Essentials on the inner network to handle ~150k messages/day for about 500 using. And I look at the quarantine folder just every other day...
I configuredthe system as follows:
- I accept only mails from correctly configured servers (reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_invalid_hostname, reject_non_fqdn_hostname)
I'm still amazed how many spammers think 'localhost' is a good idea.
- No catchall account. One of our domains was badly burnt and just removing the catchall and standard accounts (except postmaster) eliminated ~ 30k mails/day.
- RBLs. I'd recommend the zen list from spamhaus.com.
- Greylisting. Most spambots still can't handle it.
Anything else is rejected. That alone gets rid of about 50% to 60% of all messages.
Bonus: Any 'false-positive' will get the rejection message, so the sender knows his message didn't get through.
Then comes GFI:
- Virus/phishing mails get deleted w/o further notice.
- Anything that MIGHT be harmful (like password-protected ZIPs) gets quarantined. If users complain about the delay, I give them an lecture about using PGP or X.509 to safely encrypt messages.
- Anything else looking suspicious (based on bayes, other RBLs including my own, SURBLs, header checks and keaywords) gets tagged as spam and redirected to a spam folder in user's inbox.
The last part is the biggest change. It took me some time to get this through, but I feel the only person to make a decision about whether or not to delete a mail is only up to the user. My decision is based on my personal knowledge and is therefore error-prone (and if some people didn't believe this... well, let's just say my error rate increased
Try Katharion (www.katharion.com). We use it at my job and it works pretty well. You will get an e-mail once a day or once a week (whatever you set it up) summarizing all the e-mails it's blocked and you can release any of the ones you want. Check it out...
Personally my company resells a service called Appriver. This company is great. You point your MX records to them then they do all the filtering $50 a month for 20 users. They can do Open or Closed domain mode (Open means they filter all mail and deliver it to your server, closed means you give them a list of valid accounts and they /dev/null everything else. Also, the best thing is you have the option to receive an email every day of all the email that was destined for your inbox that got held up so you can release it from the spamfilter to your mailbox. Also they do statistics, we had one company that was a dance club in NYC. All that they did was send mailings to anybody that signed their guest book with an email address. On average they had 10,000 spams a day for 10 users and this was phenomenal for them.
I had a problem with spam from one of their clients and they kept claiming that even though it came from one of their servers, it was not "from" them so they could not do anything about it.
Their tech support people really knew nothing of SMTP. Even when I mailed the headers to them, they still couldn't understand it. I had to spell it out for them.
Any legitimate "email provider" must have some way to handle complaints about their customers sending spam. MessageLabs did not.
I run a shop with around 50 users and growing. I looked at various options and did TCO estimates for them and looked at feature sets and easy of management. In the end I chose to outsource our SPAM filtering to a 3rd party, namely MX Logic.
The reasons for choosing outsourced filtering/MX Logic over an inhouse solution:
1) Cost: Less expensive than choosing a commercial inhouse solution that requires annual maintenance for our size of userbase (cost would have favored inhouse solution after around 150 users).
2) Security: I don't have any mail servers open to the internet at large anymore (not even in my dmz). All incoming mail flows from MX Logic so I'm able to filter out all other incoming SMTP traffic at my firewall with an ACL that only allows MX Logic's IP block to access the mail server in my DMZ. I no longer have the whole of the asian pacific rim IP range trying to flood my mail server every day.
3) Ease of management: if a user gets a suspect message that goes to quarantine that individual user gets an email digest alerting them to each quarantined message. The user is able to decide whether to delete or allow the messages. They are also able to set an allow_always for specific senders that got quarantined. I don't have to do anything.
4) Other Features: MX Logic also scans for viruses, blocked attachment types, etc all before anything gets to my internal mail server.
Now implementation cost would be less of an issue using an open-source solution for sure, but I don't think the ease of management or firewall-level security would be as good. The TCO may actually be higher when you consider time spent managing the solution. With MX Logic I haven't had to do jack since implementation. If you do choose to use an outsourced filtering solution like MX Logic or Postini, or whatever I'd recommend using that service to relay your outgoing SMTP and create an SPF record for it also or you may have issues with servers that use greylisting.
Duris MUD - The best pkill MUD. Ever.
Fora small operation you really need to teach people to have reasonable expectations. Ten spam per day in your in box? Fifty? One Hundred?
Figure out what's a reasonable number and teach people that it's just one of those things that they'll need to deal with. No-one should expect that they'll never see any spam, or that no false positives will ever happen.
Whatever solution you choose make sure that there's a fast and easy way to search the filtered mail. At one point my former webhost switched spam filtering systems, and suddenly the only way to look for falsely tagged messages was to scroll through pages and pages of messages.
Three Squirrels
Has anyone suggested the "cleanmx" service from dragonfli.ca? I have a few small/medium-business clients I do IT support for and it's worked amazing as an anti-spam solution.
From what I understand, you point your domains' MX records to their "cleanmx" box, it does all the spam filtering, then forwards the mail on to your real MX server. They offer several behaviors like "just mark the spam" VS "delete the spam", and at the end of the month they let you know how many emails it processed for each domain, and how many spam messages it found.
They advertise no false positives and 96% efficiency on false negatives.
i was in a similar situation. ~50 users, gfi mailessentials. the software is bad -- you have to get away from it. there are too many bad things to list. try following the support forum for a month or so, and see how much progress gets made..
i moved to vamsoft's "orf filter". this cuts out about 98% of the spam at the MTA level, as god intended. (gfi accepts all mail, period, and then backscatters NDRs out into the world.)
i left gfi in place for awhile after installing orf and used it strictly as a categorizing filter, moving everything to the users "junk e-mail" folder.
eventually i replaced gfi with spamassassin for windows (http://sawin32.sourceforge.net/), an exchange event sink to score the messages before they were accepted (http://www.christopherlewis.com/ESA/ExchangeSpamAssassin.htm), and the mailshell event sink to move tagged messages to the users junk folder (http://www.mailshell.com/mail/client/oem2.html/step/exchangeplugin).
aside from vamsoft, which is extremely reasonable in price, these are all $free solutions which work incredibly well. orf blocks most spam at the MTA. anything that makes it past is categorized by spamassassin, put in the user's folder, and it becomes the user's problem. the users manage their own email, without anyone else looking at it. better for them (privacy), better for me (don't have to deal with it). the change was essentially transparent for the users; they only noticed that they were getting less junk.
i still follow the gfi support forum, but it's mostly just to chuckle. i'd love to share some of this with the folks who are struggling with the software, but any post that suggests a different, non-gfi solution is quickly deleted -- i understand they need to try to keep the rats on the sinking ship, but the censorship it pretty hard to stomach.
anyway. hope this helps.
A commercial service will probably do a better job of filtering spam than any in-house solution. Commercial services use very high-level processes, techniques, and software. Commercial services constantly update virus filters and the like. Such services are not that expensive.
one word: Sendio!
Well, it's a two-edged sword.
I run email for several of my domains through Google Apps for Your Domain - essentially, Gmail. On my largest account, I get several hundred legit emails and 200-1000 spam messages each day. The problem isn't Gmail's filtering of this - it's actually damn good, with maybe 2-3 false negatives a week and maybe one false positive. Better than almost anything else I've seen.
The problem is that Gmail gives me NO options - as a user or domain administrator - to sift through the spam box automagically, looking for those false positives. You CANNOT access the spam box in any way other than their web interface, looking manually through your spam, hoping to see the occasional legit message that confused the filters and was labeled spam. (Okay, if you go the full IMAP route, you can apparently see it, but that's cumbersome in the extreme if your users aren't doing IMAP in the normal course of things.)
This borders on perverse. How hard would it be to allow POP to the spam box, so that I could suck down the messages and run my own filters on them? And what's with the lack of user filtering options? "Um, Google, here's a hint: I don't read Chinese or Russian. If mail comes into the spam folder in one of those languages, you just delete it and not bother me with it, OK?".
Dunno, it feels like a case where someone's high up in Gmail's design group has a religious or aesthetic conviction about how spam should be handled ("no filters...no settings...no controls...no access") that blinds them to how badly this works for users and administrators in the real world.
At work we scrapped the commercial product we were running ourself, and switched to Postini/ScanSafe/Google some months ago.
The results are way better than most I have seen. It is way better than ClearSwift MIMESweeper for SMTP, and at a lower yearly cost. It also beats the free software out there.
Only disadvantage: Since we do send outgoing through them as well, we not have any definitive log of delivery. But this can be provided by Postini when needed.
I set my company up to use Exchange 2003 servers (four of them, in different sites) up with the built-in antispam component, "Intelligent Message Filter". It's configured to reject messages that are certainly spam, and send to the users' Junk Mail folders any messages that just might be spam.
There are also configurable whitelists and blacklists per user, which helps too.
Works pretty well, we rarely have any false positives.
Sure... if you want another company in possession of your company's email. How do you know the other company won't look at sensitive emails? Just because 'they shouldn't' or 'they say they won't', doesn't mean someone there won't. Heck, if people are looking up Obama's and others' passport info in the government, I would be willing to bet that someone at a third party email provider has looked at someones sensitive email. What if they get wind of a business deal on a subject they may have a business interest in? I think anyone who trusts their sensitive data to others with no real consequence to having that data leaked, is not thinking far enough ahead. It is the same reason I detest so much our data going to overseas servers.
-- I ignore anonymous replies to my comments and postings.
If you have to manually vet the contents of your SPAM filters, something is wrong.
Buy a filter that allows end users to scan filtered mail and manage their own queues. Barracuda Networks is one we have used for SMB's and it does quite a good job. I think Symantec's tool can work in a similar fashion.
-Paul
It's part of your job to get "bitched at." Try sucking it up and being a professional. These are complaints, not idiots bitching you out.
Nuff said. An org your size would have minimal expense, and its all pretty hassle free.
My university, UCDavis, filters spam but sends a spam log at the end of the week (or day). Messages can be retrieved if they aren't spam. With this method you could tighten you filters a bit, while allowing people to check for themselves.
Two things...first use some kind of web interface that the users can check themselves whenever they feel it's necessary. Second, consider outsourcing the spam filtering to someone like Postini. They do an excellent job and all the bells and whistles are there, plus, you can send outbound mail through them, too. Thanks, Chaz
You shouldn't have to review all spam, check it at smtp-time instead and reject. Mark the uncertain as Spam and send to the enduser.
We use exim with a config from http://www.jcdigita.com/eximconfig/ It works very good, most of it is automated and we use about two hours a month for administration, We have 450 users, and it is a wellknown domain since 1995.
The catch is that you need a good understanding for what spam is.
No, you did not understand. The headers from the spam showed that it came from their server. MessageLabs' servers. Those were the servers connecting to my server and sending the spam to me.
I had to break out the headers to specifically show them that. I had to do that because they seemed incapable of reading the headers themselves.
MessageLabs sucks.
I go to Johns Hopkins University and they have a pretty effective way of dealing with the whole spam situation. Firstly, users can opt-in to the spam filtering system, which means that each user knows if they should expect emails to randomly disappear. Now, if they do opt-in, all "spam" is sent to an isolated quarantine inbox (as one might expect) by analyzing TO:, FROM:, Subject:, etc fields. The interesting part (which I think would solve your problem), is that if a user's spam inbox contains any messages, the spam daemon will send the user a digest email, containing a brief description about how it caught __ number of emails, etc. and will provide the subject headings for each email, along with a link to see the entire message. The user can then specify how often he/she wants these digests, which essentially guarantees that in a given period, the user will only have to consider spam emails once. Finally, the spam daemon automatically kills any emails left in the box after a certain amount of time. This also has an added security benefit: emails classified as spam are never sent to the user (unless they explicitly request it), which means that if the message were to contain malicious attachments, unwanted images, etc, they are not at risk. Anyway, just might be something you want to think about.
Just outsource it. There are plenty of services that will do the job for you, and they're very affordable, especially compared to the cost of your own time. Postini for example is fantastic; we've been using them since before Google bought the company, and they're quite effective with very few false positives. At about a dollar per mailbox per month, you almost can't afford not to do it.
Tired of FB/Google censorship? Visit UNCENSORED!
I've found a combination of SpamAssassin running with Postfix particularly effective. Set it up to autolearn. I use Exchange/Outlook so I set up Outlook rules to move everything with the [SPAM] subject tag into a subfolder, so users always have a copy of the spam that was caught. I also have a Spam public folder that people drop their false negatives into and I use Fetchmail to grab the messages daily and manually learn from that corpus. Set up Postfix to enforce SPF records. Having this on a different server than your mail server gives you the extra benefit of indefinitely spooling mail if your Exchange server goes down, or going directly through if the spam filter goes down. Here's a great article on setting it up: http://advosys.ca/papers/postfix-filtering.html Alternatively, MX Logic does quite a good job if you're OK outsourcing your filtering
"Of course life is bizarre. The more bizarre it gets, the more interesting it is. The only way to approach it is to make
As you may know, it used to be that Postini was considered, by those of us in the anti-spam industry, something of a black hole, and not a service we would recommend.
However, having been in touch with their executive team in recent years, I had inside knowledge as to how that was changing - how they *wanted* that to change.
Recently, we decided to take our own spam filtering outside, to let someone else's servers do the heavy lifting. We tried several solutions, and finally, almost in desparation, I gave the 'ok' for us to try Postini (which of course is now owned by Google, but the exec team is still in place).
Let me tell you that we were *extremely* pleasantly surprised - the service really has been *very* good, it was relatively easy to set up (you do need to be familiar with how to set up your MX records, etc., but if you are already adminning a server, you should already be fairly comfortable with that).
The price is good, and the end user UI is excellent in that it's pretty easy for an end user to understand how to scan their "spam folder", how to get something delivered out of the spam folder, how to whitelist a sender, etc..
Honestly, it's one of the easiest-to-use of the offsite systems out there - and one bonus is that it gets the user support *off* internal admins.
And, the false positive rate is low, as is the false negative rate - which really is the bottom line test for spam filtering services.
We have a formal review for our corporate blog (http://www.TheInternetPatrol.com/) in the works, but in the meantime consider this an endorsement of Postini from the Institute for Spam and Internet Public Policy (http://www.isipp.com/)
Anne
Anne P. Mitchell, Esq
CEO/President
Institute for Spam and Internet Public Policy
Professor of Law, Lincoln Law School of SJ
Author, "The Email Deliverability Handbook"
I've built this: http://www.gentoo.org/doc/en/mailfilter-guide.xml, when i was tasked with setting up mailfilter. It works great and is also scalable with some LVS if you really need it. There's always GMail for business (former Postini) mailfilter (which is pretty cheap) or a ton of similar solutions out there that will do it for you.
We have been using a SpamTitan (http://www.spamtitan.com) virtual machine for approximately a year now and it works very well. I bought the license for up to 100 users, downloaded the VMware virtual machine image and converted it to run on ESX server. Highlights:
* The interface is very impressive and setup was quite straight forward - no reading of the manual required.
* Uses two anti-virus engines: Kaspersky and ClamAV
* Uses OCR to detect image-spam
* Multi-layer anti-spam approach - scoring from several algorithms is compiled to provide a single spam score.
* The product checks for valid recipients (including aliases) against my Exchange server.
* Logging and reporting are excellent.
* There have been some false positives and initially it didn't block as much spam as I had hoped but as the Bayesian analysis has improved so have the detection rates.
* Afraid of false positives, I initially monitored the quarantine and white listed many of the the domains belonging to suppliers and clients.
* I am not yet sending outgoing mail through my SpamTitan but this would improve the filters as well using what they call "PenPal bonus".
* After a version upgrade, the ClamAV definitions were no longer being updated. I contacted support and they connected from remote (via a tunnel I opened) and fixed the problem. An excellent support experience.
* The users control their own experience - I have configured it to send each user a daily digest of mail that has been quarantined since the previous report. Each user then manages their own quarantine, white list, etc. Training has been minimal and response has been very positive. I was surprised to find that we are averaging only approximately 12% legitimate mail.
* smtp relay, so if it's overloaded or down, mail can keep flowing to your mail server based on mx record priority in your DNS
* allows whitelisting at both the user and domain level
* users can log onto the web interface to force a message to be released from the quarantine in case they know someone sent them something they didn't get
* a daily log is sent to the users (if requested) that contains all of the quarantined emails, along with a link that the user just needs to click on to have that message released from the quarantine and forwarded
I set this up in a VM, and it handles about 30 mailboxes which used to get upwards of 100+ spams a day each. Now I get one or two spams a day.
There is both a free and purchased version of MailCleaner. I highly recommend you pay for the commercial version to support their efforts. Of course, you can try the free version first to make sure it works for you.
http://www.mailcleaner.org/
http://www.mailcleaner.net/
Red Condor. 'nuff said.
http://assp.sourceforge.net/
I've used a number of spam filters and none of them have been as effective as ASSP has. I highly recommend it.
I am looking after the mailservers of a hosting company, providing services to about 100 smaller companies. As we are hosting ourselves on the same servers as the customers spam has always been a primary concern.
To keep costs down most of the stuff we use (apart from the virus scanner) is OSS.
1st layer of defense are RFC checks run by postfix before accepting the mail (mentioned earlier)
2nd layer is several RBLs (about 11)
3rd layer is SQLgrey greylisting, did magic for us and lowered the spam messages processed on the server by about 70%
4th layer spamassassin with Razor, DCC and F-Secure antivirus plugin.
This does a pretty good job, I still get about 1-2 spam messages per week (instead of about 100 a day that attempt to be delivered).
Why? The whole point of junk mail filters is so that people DON'T have to look at junk mail. I get about 10,000 junk messages per hour. I cannot look at them even if I wanted to. My junk filters are 99.999% effective, so only about one of those crap message slip through to my inbox per hour and I still find that annoying.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I've faced the exact problems you describe, have tried the oft-touted solutions, and (since you're not averse to a commercial solution) I can tell you the answer:
http://www.cloudmark.com/businesses/
I love it because (a) it eliminates a very high percentage of SPAM, (b) it has an extremely low false positive rate, and (c) it requires no fiddling - one easy installation and then forget it aside from occasional updates.
A big part of what makes Cloudmark Server Edition effective is human feedback. When a user flags a message as SPAM this sends information back to Cloudmark which helps identify SPAM for other users. Votes from users with a proven track record of accurately identifying SPAM are weighted accordingly. Due to to the large number of CSE users the system works amazingly well. It is by FAR the best solution I've tested. Bayesian filters, for example, require endless tuning and are subject to poisoning attacks. Greylisting is helpful, but it works on the assumption that spammers will never attempt delivery twice. I don't know how valid that assumption still is.
The Cloudmark website talks only about Microsoft Exchange, but there are versions of CSE that work with other types of mail servers.
I'm blocking thousands of junk messages every day on several servers with almost zero time spent on administration. Do yourself a favour and check it out.
I use spamd -> Barracude -> SpamAssassin -> whitelist
I haven't gotten an e-mail in 8 months.
A sysadmin I know runs maia mailguard (with spamassassin, clam-av[?]) on his small-midsize network, and since the users train it, and also get to see all their spam (if they want), they get to feel in control. Of course getting users to train it is a social issue. http://www.maiamailguard.com/
I run IT at a small, mostly mac-based outfit. We tried client-side filtering (SpamAssassin), and the Mail.app plugin was OK, but - required constant training by the users to get good results - until spammers attack methods changed... then we waited for the plugin to be updated, etc. This was not a good solution - we have a 'few, very productive employees' setup rather than an OfficeSpace / lots of drones setup, so any lost time is bad news. I then tried using Spamphibian (setup as a dedicated filter on a spare box). Total failure - LOTS of stuff got through, bad support from the parent company, slow filter updates. Terrible. Then I tried Barracuda. WHAT a difference. Easy to setup, very very effective filtering, user-level training if desired, user level quarrantine-of-might-be-spam - so I the Admin don't have to review EVERYBODY'S junk folder for false positives. Sure, the product could be improved, and I totally agree with the back-scatter critique. But - if your time is valuable and you want your spam problem 99% solved, just install this thing. I love it. No, this isn't astroturf - I just like this tool very much.
I personally love ASSP (anti spam server proxy) for my clients.
It has a great deal of flexibility and since the highest false positives are flagged by the bayesian engine, you can set that specific filter to use "testing" mode which flags those messages with a subject line like [SPAM]. Couple that with a client side rule to deposit messages with that subject line into the junk mail folder, you then can allow employees to go through their own messages to look for their missing mail.
ASSP also has a feature to allow for users to contribute to the filtering rules, so the filter gets more accurate over time. They can send messages that get marked false positive to an internal address that modifies the bayesian database so that messages of that type make it through next time. That feature also white-lists the sender's address along with simply sending that recipient a message.
By far, it is the most flexible and powerful spam filter I've ever encountered and would highly recommend it for any small to medium sized business.
What you want is for the hosting company to send you (each user) a digest on a schedule of your choosing. That digest will list all the items waiting in quarantine for you. You look at the items in quarantine, and release the good mail.
The product should learn to pass the items you release. That's something I'd ask. GWAVA does it, and I'm sure other systems do too.
If the product doesn't learn, and instead wants you to manually configure your exceptions list - I'd pass on that product.
You want to keep the crap out of your mail system - so make sure the quarantine is the providers problem, not yours.
"The most sensible request of government we make is not, "Do something!" But "Quit it!"
Use at least a 2-tier system, 3-tier if you include end-user filters. I use a CSC-SSM (with a plus license for anti-spam and some web content blocks) that uses Trend Micro tech in an ASA 5510 to block a large chunk of malware at the firewall level. Spam that passes through that then has to travel through a Symantec SMTP gateway which includes my content violation rules, such as any subject line ending with an exclamation point is rejected, a few dictionaries for various sexual words, some 3rd party DNSBL and DNSWL sites, and a user directory sync that rejects all external mail that doesn't include an existing user in the to/cc/bcc fields instead of forwarding all that crap to my catch-all address.
Then if users miss any critical mail, I have them submit a ticket about the address in question, and either whitelist the specific address at both tiers if its a personal address, or whitelist the domain at both tiers if its a legit business contact. The rare spam that gets past and people complain about I usually just have them block the address from their client, though sometimes the spam jumps out at me as an easy rule to create on the content scanner smtp gateway level.
And of course, I send myself daily reports about spam trends from both systems to check on trends instead of logging into my MTAs every day. This is for a company about 80 employees strong.
Protector of Capitalist views,
Meorah
As a happy end-user, I'll throw my two cents in for www.calyptix.com. We've started using their AE500 series for our office (Granted we're small, but the product is solid) and I have had only bulk-mails getting blocked at the onset (such as noreply@tigerdirect... etc)
Combine that with something like spambayes and properly configured, and within a few months, your users will not have hardly any spam in their inbox. Want a 3gb pst of pure unadulterated spam to start your filter? ha!
2^3 * 31 * 647
Depending on the organization's size and how vigilant they wish to be about what gets through, why not consider outsourcing mail scanning to an off-site 3rd party like MessageLabs, Postini (Google) or similar? Mail scanning is not our core business, so it doesn't make much sense to dedicate many resources to it. Sure, some companies may have rules about who is allowed to view their mail, store it, blah blah, but having worked with MessageLabs in the past, they've got a slick product that provided good admin and end-user interfaces, and was priced decently per-user.
I'm a computer consultant for small to mid sized businesses. All of our clients are in the same position of having 15-75 users and needing some sort of spam filtering.
We have found that outsourcing the issue to SpamSoap (spamsoap.com) to be an ideal solution. They use MX Logic's technology, which is very good. The pricing is geared towards small to mid sized companies.
Each user gets a spam quarantine report email they can use to manage their spam directly from the email. And all spam gets filtered before it reaches your network.
Nice simple basic install, then (as I was running on windows) a bit of tweaking to get it running as a service - and it's been pretty much faultless from then on. Currently setup so 'spam' is subject flagged by assp, mail server chuck spam flagged mail in separate folder on user machine, so it doesn't end up in inbox (but can be checked for false positives). Spam/Ham can be reported by end users just forwarding to a couple of mail addresses on the server - and if that's too hard for them to remember, then can just add some buttons to their mail gui.
I use a product called Untangle, available at http://www.untangle.com. It uses Spamd, is pre-configured and is easy to setup. You can use an old piece of hardware with it and it does a fantastic job for our organization.
Give it a try. It blocks out about 2400 e-mails daily that get through our SMTP relay using MailSecurity.
AFAIK, most good spam systems involve defense in depth. My suggestions are:
greylisting, which will cause some messages to be delayed, but is a fantastic weapon against spam when used with...
RBLs (see other comments). Pick one that suits. The reason this is so good when combined with greylisting is that messages that have been delayed may well now have their originating IP address one of you RBLs.
Optionals at this point are SPF (requires other mail servers to have the appropriate dns records), checking that emails sent are valid (there are other comments here about this).
Up to this point, you have spent very little bandwidth. All messages that are considered spammy have been dropped. You have also spent very little CPU time.
Next line of defence is something like spam assasin. This can perform bayesian filtering on the email. This is configurable, but generally the best option is to set a header in the messsage, so that client side email applications can filter them out. This then leaves it up to the users to check their own spam folders.
Lastly you could add something on the client, but it might be a little overkill.
All this can be done on a standalone server sitting between your current mailserver and your router. There should be plenty of guides out there for this. Eg this or this.
meh
1 persons vs everyone losing 30 minutes per day? Far out.. there are alternatives.
We use SpamSentinel (a Lotus-Domino-only product). It's centralised and self-serve at the same time. SS has multiple engines; anything tagged by more than one engine is immediately dumped (now rejected at SMTP). The "maybe"s get quarantined, and users get a daily list of their quarantined items with hotlinks directly to the quarantined messages. From there it's only 1 click to release, or to whitelist the sender.
I say self-serve is great. It takes me about 5 seconds to scan my daily list (of 20-50 "maybes"), and I've got a better chance of recognising my own legitimate mail than someone else does.
Surely there's something like this for non-Domino folk.. surely..
-- All your bass are below two Hz
...they want their post office back.
When in a similar situation administering multiple domains, I found that grey-listing gave the most bang-for-the-buck by eliminating roughly 90% of the SPAM before it got to the heuristic-based filters. It also reduced the CPU/IO load on the mail server since it requires very little on the server end to just tempfail a message and stick it in a hash. There were no false positives reported from the grey-listing.
For those who do not know, I am referring to temp-failing messages from senders who are not already white-listed. If the user's client or upstream mail server does not bother to retry, it is almost certainly a mass-mailing program. For the small number of mass-mailers that handle grey-listing, it still naturally throttles their traffic and the SPAMmer still has to get through the rest of the SPAM filters. By letting grey-listing have a crack first, by the time you sit down to examine the quarantined mail by hand, there isn't anywhere near as much. It requires no interaction by the sender and, if you do hit a false positive, they get a normal bounce report and know to try again or give you a call.
www.mailscanner.info
End of story.
I am personally using my own mail server and I did the simplest possible thing - every incoming connection is checked against dnsbls: sorbs, spamhaus and spamcop (all three allow you to look up addresses for free). This blocks nearly all spam and after nearly a year I've never had a false positive.
If you are into setting up and running something yourself, you can use spamassasin (free oss). This is not terribly hard to set up, but worried about false positives I never really used it. I am filtering for a small number of savvy people using Thunderbird...
Speaking of which, thunderbird has a reasonably decent filtering feature. It takes a while to 'learn' but it has been quite useful in filtering out the few leaking spam messages from dnsbls.
There are countless commercial packages and I bet somebody else will cover that. Hope this helps
Appriver's spam filtering service (AppRiver.com) is your best friend. A couple reasons it's great:
* AppRiver's spam filtering is extremely accurate - in the very high 90's.
* AppRiver is a hosted service, so there is nothing to install, maintain or upgrade on your mail servers. As I recall, they went down for a total of an hour in two years of using them.
* AppRiver pushes the spam message reading from you to the users. Every day, each user gets a single message from AppRiver listing all the spam it's caught in he last 24 hours. If the users find a good message, they click a resend link in the message and it's resent to their mailbox. They also have the option of requesting (with your approval) that all mail from a recipient be allowed through.
I worked with a 40 user company with e-mail addresses published on the web and I spent less than an hour a month working on spam filtering. I don't remember specific pricing, but I want to say it was $20 per user per year or less.
I'm not affiliated with them - just a happy customer.
You could try using the Abaca Email Protection Gateway. They claim a 99% accuracy rate and there's an option for a 30 day free trial on their site.
I've never used it but I've heard good things about it.
The business I work would qualify as a middle-sized corporation.
We run into the EXACT same issue you're running into.
The dilemma is if we don't tighten the spam filter enough, we'll get complaints from employees (who are not shy about sending EVERY LAST PIECE OF SPAM THEY GET to us.)
However, if they tighten the filter too much, then important emails that may seem spam-like begin to get blocked, and we get just as much heat for that.
The answer - do your best to block what spam you can, and if you get complaints about some spam slipping through, tell them to delete it. We'll often add that we're working with the spam filter vendor to try and resolve the issue, but it's not that easily resolved.
And no - we don't go through each message looking for spam - it's not practical due to the number of employees we have. We DO give them the power block spam from specific addresses on their own, though. The benefit of this is the email is sent to a junk mail folder they can still access, which is useful should something legitimate end up there.)
How about Google's offerings?
How does the service work? You change your MX records to point your email traffic through our Postini-powered data centers. To fully protect your organization, Google recommends that all customers configure their gateway to accept email traffic (port 25) only for the Google IP range. After activation, you can add users through the Administration Console and configure your filtering policies.
More FAQ
I've been using it for two months now and it has been very effective and flexible.
Learn the RFCs (2821, etc). Use the RFCs against the spammers.
Most botnets are effectively blocked simply by intelligent use of DNS MX records. Make the first MX record go to an IP with a firewall against port 25. Subsequent MX records go to IPs with normal MTA listeners.
Use a DNSBL (like Spamhaus ZEN).
Use GreetPause (delays for a second before issuing the greeting; if sender has activity during this delay, reject the connection).
Use Greylisting.
Get aggressive, and filter on SPF failures (if the IP is not authorized by the purported domain, reject the connection). Yes, certain list-serves will fail SPF checks for certain sending domains, but list-serves can be modified to work properly with SPF records.
Get aggressive, and filter on DKIM failures (if the DKIM signature is not authorized, or is wrong according to the current content, reject the message).
Mark emails that fail custom content filters, and pass to the customer. Have the customer implement a client-side rule to file all emails with the "SPAM" mark into a Suspected-Spam folder. Educate the customers to monitor and clean this folder periodically.
Provide a simple feedback mechanism for customers to send you the email source code for spam that slipped through all the filters.
DKIM-sign all your outbound emails, so others can pick your legitimate emails out from the forgeries.
Publish appropriate SPF records for your domain, so others can identify correct relays purporting to send from your domain.
Support TLS (Transport Layer Security) on Internet connections.
Enforce TLS for select important contact domains.
Coordinated TLS partners can be exempted on the 1st-MX firewall, to circumvent your anti-spam measures (but virus-scan ALL email, still!).
Using the above connection-centric filtering methods will minimize your need for transient custom content filters.
I have been using CanIT from roaring penguin software for about six months... and it has been fantastic. I highly recommend it to anyone that needs to manage their spam.
I just have to make a comment for an amazing fix for users in the 1-200 user range. There is in outfit in Chicago, IL called ONLINE SPAM SOLUTIONS. ONLINE SPAM SOLUTIONS - WE STOP YOUR SPAM, YOU DO NOTHING! http://www.onlinespamsolutions.com/ They provide an amazing value for Spam/Virus filtering. Prices start at $9.95/mo. I found them through Google, and it has been the most amazing find ever. We run an Exchange server with 25 users. We used to see over 200,000 messages per day hitting our server. This of course caused delays in the SMTP engine, and generally bogged down our server. We now see less than 1500 message per day hitting our box, and NO SPAM! These guys have excellent customer service, and are easy to setup. I highly recommend them as a solution! Particualarly in your case for 50 users.
1. - Use this (Postfix):
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
reject_unauth_pipelining,
2. - Use those black lists:
safe.dnsbl.sorbs.net,
zen.spamhaus.org,
bl.spamcop.net,
db.wpbl.info,
dnsbl.njabl.org,
psbl.surriel.com,
list.dsbl.org,
3. - Add manual filtering in order to block things like:
3.1 - Mail from HTTP client (MSN webmail, yahoo etc) from certain countries (in our specific case, several IP ranges from Africa).
3.2 - Mail from detected spam-servers (self-called advertising services).
3.3 - Etc you like.
4. - Create a bunch of scripts to generate statistics on connections-per-host etc.
Check those stats from time to time (at least once a week).
This way you may easily find offenders.
It works for our server, rarely we do have false positives.
Our server blocks >20.000 spams a day (> 500.000 a month).
I get about 1 spam message a week on my Gmail account, despite several wild-carded domains pointing to it. I noticed this a couple of years ago, when I was struggling with greylisting, spam assassin and spambayes. So as a test, I set up a Gmail account for a real-estate agent customer, who has a very problematic message profile (lots of real messages with "mortgage" and "loan"). I set Gmail to forward messages straight on to a second mailbox on my mail server, from where the customer picked up his mail. The results were fantastic - he gets hardly any spam, and hasn't had a single false positive (that he knows about). Plus he's worked out he can access his mail away from his computer. And all this with no training, which customers hate doing.
So if your company can handle the idea of all their emails going through Google, Gmail is a great no-cost solution - you need to set up a Gmail account and two mailboxes for each user, but Google does all the hard stuff, saving you from buying meaty hardware for all that spam number-crunching.
Do as you would be done to.
First, use "smart" greylisting. That will temp fail (4xx) messages from domains/ip allocation combinations you do not know to be "good". After that, use the other kind of grey listing that rejects messages if there are any pre-chat commands from the sending system. That stops an incredible amount of viruses without having to virus scan. (But not all!)
Second, use TLS with important/large customers. These emails should completely bypass any spam filtering, but never virus filtering.
Third, insted of hard bounces (5xx), accept the message but quarantine it. Allow the end users to see their quarantine queue and review the message, and gate it in if good. I'm not aware of any open source that does that for you, we hacked up our own using MailScanner.info as a base (and it is pretty ugly, otherwise I'd submit it). Many commercial products have that built in. MXLogic for one. There are lots of others.
Lastly, it shouldn't be just one person on the spam queue.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Dspam has been running at our site for about 2 years with results nearing 99.9% accuracy.
From their site:-
DSPAM's philosophy is based on the belief that machine-learning (basic artificial intelligence) can, in and of itself, solve the spam problem without the need for human-maintained rules, inaccurate blacklists, or any hodge-podge of solutions for that matter. DSPAM's one central spam detection function incorporates advanced, concept-based statistical analysis. This has resulted in levels of accuracy up to ten times that of a human, with very few false positives. DSPAM breaks down each email into its colloquial components, analyzes the historical data for each component, and determines the most interesting characteristics to judge an email by. While DSPAM supports many pre-filters, post-filters, and additional layers of analysis, its central function lies solely in adaptive learning and language analysis. This alone has yielded levels of accuracy peaking at 99.991%.
I have resold, installed, supported more than one anti-spam solution for my customers. The #1 feature that saves the sysadmins from having to skim through the quarantine on a daily basis is the spam reports.
You see, most commercial solutions (and even MailScanner, a SpamAssassin addon) allow for configuring email reports that are sent on a daily basis to users. These email reports list the content of the user's quarantine, and usually feature one-click release capabilities, so that users may easily release any false positives. This transfers the quarantine management responsibility to each user, and admins rarely need to get much move involved than the occasional explanation of the report's function.
This type of feature is indispensable in larger corporations, and since it does not require the user to login to their quarantine through some form of web portal (they just have to read the report in their email), it does not result in a very involved process for the users.
I have seen Symantec, Vircom, Fortinet's Fortimail, and others make use of spam reports. Do some research and you will likely find the feature on most commercial offerings.
The commercialized gmail offering comes with spam filtering, the gmail user interface, and remote access from anything with a browser. Is it critically important that you manage your own mail servers in house? For most people, not really.
In any case, reading subject lines of the whole company's trapped spam is insane and a losing battle. I would neither want nor be able to keep up with my own mail that way, much less the mail of myself and 49 other people. Your time would probably be much better spent doing something else. In gmail, by the way, users can check on their own trapped spam if they want, or just ignore it (which takes the responsibility off of you and means you wouldn't get bitched at).
Have you been using the public folders that GFI makes available to designate e-mail messages as SPAM or legitimate? Have you been using the auto-whitelist feature? These work wonders for the 50-person companies that I work with. Some of my GFI installs are going on 4 years, and I haven't really had any false positives in 3.5 years.
Any e-mail user these days needs to understand what their junk mail folder is and that they need to check it occasionally. The most computer illiterate owners/CEOs of companies get this and would never presume to make someone else do it for them. If they think e-mail is critical to their business and they're not big assholes, they understand that options are 5000 spam messages in their inbox a day or the possibility of a false positive.
Luckey you.... I get about 8000 spams a day, and that's just ONE account. Spammers hate me... I wonder if that had to do with the fact that a while ago, I was responsible for "nuking" more then a million infected hosts a while back... Sheesh, it's like swatting flies...
:-)
I deply a two tier filtering system. HTML Formetted text and misspelled words immediately get hosed. Next, my Bazian filter gets it... by the time it gets it, almost all words are correctly spelled english.
Next, I spend about 10 mins "manually scanning" the spam by displaying the messages in a way that makes "good mail" stand out easier. If my filters are good, no good mail winds up in there. The best way to do that is if you displayed only the from and body of the message (in a rather long line). Good mail really stands out, as most is in HTML formatted or other garbage.
Every week, I have to go through and customize the flter to make up for changes in spammers methods as they continue to change their tactics. I run the spam through a processor (which takes a long time) that analyses the words used in the spam messages and pulls out the largest number of occurrances which is used in the "pre-filtering" part.
If I had my way, all private corporate Emails would be "white listed", but some people don't like that. For me, "white lists" rule...
k
save yourself some time and just go with untangle
I'm surprised that nobody has mentioned "Maia Mailguard." http://www.maiamailguard.com/ I've never used it and would love to hear about it from folks who have. I was planning on getting around to test it one of these days...
Untangle has 20-30 of the best open source security apps with an easy to use GUI. It also has optional VPN, remote access portal and a couple commercial apps. You can download it or get it as a per-built appliance. It's simpler and much more elegant than a DYI solution. It's free or a lot cheaper than other appliances with less features, if you buy the subscription.
It's free open source, you can integrate anti-virus with it (ClamAV). It WORKS!!!! And it beats the bejesus out of Trend Micro Interscan Viruswall- which was what we were using previously on so many levels it isn't funny! For example: System requirements: Trend Micro: 150Mb RAM + 1Gb disk. ASSP: 80Mb RAM + 50Mb Disk. I've gone from a system that downloads all mail to process it (an enormous waste of resources) to a system that rejects about 90% of connections and cans another 5% based on content. Not only that, I got rid of Trend Micro Officescan and replaced it with ClamWin. The only thing Clamwin doesn't do (Yet!) is on access scanning. So if you download a file which you suspect, right-click to manually scan. Again, significant savings in terms of disk, client and server resources at the disadvantage of no central logging. I'm not missing it though...
My company will be installing MailFoundry in the next month. It has shown to catch more spam than IronPort and ProofPoint in our internal testing. It was also a lot faster than the other two. We have been having issues with Postini catching false positives and not allowing us to filter our outbound mail.
MailFoundry offered great kill rates, faster throughput and outbound filtering for a cheap price.
They're definitely worth a look.
Small business Server . The linux way. http://www.smeserver.org includes spamaassassin and a whole host of sensible defaults.
i was in the same boat.... or close to one.
we were (and are) running exchange. we were using NEMX for spam filtering. it's not that it's a bad product, but it required too much hand-holding and reviewing the contents of the Junk Mail folder for false positives. like the original poster, i would get complaints if the filtering was too loose, or too tight.
then, i read about the deep6 ds-200 in windows secrets. like many other appliances, it's another embedded linux box. basic interface is just that - basic.
but i decided to get one.
that was 18 months ago.
false positives are rare. barracuda-type bouncebacks are nonexistent.
as you can tell from the different postings above - there are a lot of great solutions out there. this one worked for me.
best of luck to you.
To have ambition was my ambition.
Ferris Research is one of the leading analyst firms covering email. They outsourced their OWN email to Google Apps, and I followed their example.
DDOS attacks are now a thing of the past for me. The spam filter has JUST enough false positives I sadly have to scan manually, but in fact I've never been greatly inconvenienced by one. The false negatives are fairly mild.
There is no such thing as anti-spam with 100% accuracy both ways.
And by the way, challenge/response is a TERRIBLE idea -- it causes huge amounts of backscatter spam pollution, and it also inconveniences potential customers trying to reach you.
CAM
To err is human. To forgive is good system design.
College-Pages.com - Online Colleges, Degrees, and Programs
searching on google did find this Google Apps Administrator Help page. So it looks like because the
Google has one of the best spam blockers in the business, and it's integrated into Google Apps. Spam is purged every 30 days. We have built in virus checking, and we enforce checking of documents before allowing a user to download any message. Most computer viruses are contained in executable files, so standard virus detectors scan messages for executable files that appear to be viruses. Google blocks viruses in the most direct possible way: by not allowing users to receive executable files (such as files ending in
Granted I don't run a site as large as you ask, but in my case, the solution to spam was simply to start off with a good system (debian, spamassassin, and subscribe to some filter list).
Then each user's spam is moved into a folder within that user's mailbox. I instruct my users that spam messages are put there by the server for 7 days. If they want to find a false-positive, it'll be there.
After 7 days, my mail server eats those emails and feeds them though the Bayesian filter learning tool of spam assassin. At the same time, the learner scans the user's general inbox for HAM.
This system, after being deployed, took about 2 weeks to learn our mail. After that, it went to practically zero false positive and zero false negative. I'm not even the MTA, so I can't run any blacklists, but still this simple user-generated decisions of spam has proven to be extremely flexible and efficient.
As soon as one of my user starts to receive a new type of spam, it will be quickly learned and apply for the company.
So finally, I rid myself of the task of checking the spam boxes, by handing it over to my users.
I've been using ASSP for some years now - it gets better and better and, because it's a proxy, doesn't involved hacking and patching your MTA to implement. http://www.asspsmtp.org/
Do you really manually check spam for more than just yourself? I am sorry, but that is insane! A mail admin I once nearly worked with, had a nervous breakdown because he was manaully checking the processing in the queues all day. Your solution sounds no better than that. I am sure you are being paid for it, but I think you could probably get compensation for having to do such a thing.
In today's modern world, you are probably not left with enough time to look for a new job, and you need a job to pay the bills right? Well, not so long ago, slaves were able to plan and make escapes. If I was in your shoes, I would be looking rather enviously at the concept of slavery!
So, what do you do?
First step is really easy, and it will buy you time for the subsequent planning. Get your boss to give you an old (but not too old) PC. Get as much RAM for it as possible (scavenge other PCs). Build a linux install (take your pick, but SuSE and Mandrake are good for beginners, if advanced, go for whatever you like).
Load this up with the basic MTA (if SuSE it will be postfix, but sendmail and a few others are also excellent. Don't use qmail).
Configure it to use spamassassin to filter all the mail (using a milter) and to relay all the non-spam mail for your domain to the internal gateway.
This will block >90% of the spam (may be more, dependent on spamassassin configuration, mine hits >99.5%).
Now you will find some time to recover your sanity and make phase 2. This should be either, find a new job (recommended) or find a better anti-spam solution.
If you architect it properly, with open source solutions (standard interfaces and nothing specifically "clever") you can easily build a "postini" like service for nothing except a bit of effort. You will of course have maintenance, and trouble shooting tasks, but compared to your current daily work load, that should seem like a holiday.
I'll toss in a vote for ASSP
http://assp.sourceforge.net/
Hi. I have implemented greylisting (package postgrey for debian) on our company server (cca 120 accounts). The level of cpam dropped significantly and I have not received *single* complaint about it.
I am a systems admin for an accounting firm of about the size of yours, and I used to use GFI's mail filtering software plus others to try and filter spam onsite. It quickly became apparent that it costs more in my time to care of this, monitoring and tweaking, than it does to outsource. I came across a firm called Inbox Genius, which is part of MailFoundry who are different in that they only charge for email addresses they filter. Out of our 50 employees only about 20 actually have a problem, so we filter those only. The first 10 are free so it costs us less than $10/mo. Therefore, if you are spending more than a half an hour a month messing with this then it is wasting the firms time and money.
Have a look at the walkthroughs at FreeSpamFilter - they have how-tos for most flavours of Linux as well as OpenBSD and FreeBSD.
If you follow their instructions you will end up with a spam filter appliance based on Postfix and SpamAssassin. If you add Webmin you get something fairly similar to a Barracuda (without the privacy concerns, backscatter problems and blacklist abuse) for the price of a commodity box.
My company has used email filtering services from MXLogic for years. I am sure that there are other equally competent service companies that you can compare if interested. This service allows staff to perform revenue - generating work and not fool around with managing spam and so it is very cost effective for us. The service gives each user a console to manage filtering, malware detection and so on. The licensing is by user. Good luck with your research.
Our company uses IMail Server Plus. It is our email server which comes with carrier-grade spam filters built in. So, we do not have someone manning a terminal manually eliminating possible spam. The irony of this is that your company pays for a full-time employee to manage spam when in reality they could make a minimal investment that requires minimal time to setup and maintain to be virtually spam-free. Odd. What type of business is this? Would they pay me to make sure the lights stay on in the building? You know...walk around all day and ensure that the switches are in the up position? Sounds like you've got a cush job...don't let your employers learn about the Google. They MAY just think to type in "anti-spam" and then off goes your job.
use http://www.astaro.com/
- either the appliance (i have not used the appliance yet) or download the software (version 7 has the best features) and use it on a spare computer. i use it at home and work and love it.
specifically re: spam -
I agree with philosophy of earlier poster - gotta take a multi-layer approach, a good firewall / proxy like astaro is just one link.
astaro lets you set up pop and smtp proxies so you can check with their rules and filters (updated daily) and or your own, plus users get a daily quarantine digest so if something is being held they will know and it can be released (but only by and administrator - so you get to be in the loop if they want the email) - plus you can filter outgoing so as not not propagate if you get infected, plus you can do white and blacklist, plus AV scanning, plus... (you get the idea)
can try it out for free as well. (no, i dont work for astaro - it just has been very useful to me).
r.
We're presently blocking between 750,000,000 and 1,000,000,000 spam messages per month, and allowing in about 1,500,000 "good" messages (which includes spam that defeats our defenses) in that same time period. 99% of all email that hits our perimeter is blocked, and our analysis of the "good" email indicates the actual success rate is about 99.9% of spam that targets us is blocked, which is a very high ratio.
Since we put in this solution, we get almost zero complaints from our user base. The typical user receives no spam, and we have a very small number of users who see up to 2-3 a day, which we find acceptable. We might see a false positive once or twice per month, which, across 35,000 users, is very acceptable. It's flexibility and rule processing has also llowed us to address a number of business requirements for message routing & processing. I highly recommend this product if you are looking at a commercial solution. They do have products for a medium sized business, as well as enterprise class environments.
-Lokatana
Well no one has mentioned messagelabs.com and been modded high enough for me to see their comment.
We use them. I don't rightly know how they do it, but their false positive and negative rates are as close to 0 as you'll see anywhere. If you're going to spend money on a spam solution they're the ones to get.
Of course that's a big if. And for another big if, if you're willing to put up with a non-zero error rate, then many of the free solutions are great. Just remember that blacklists are Baaaaaaaaaaaaaaaaad
Most of the users are SMBs, between 50 and 500 users. The subscription does most of the work, and the users have self-service to the quarantine, which takes the load off of the administrators. Any product that you pick should really only require 15 minutes or so each day to check that it is running, and have a self-service component, otherwise you will spend all day managing spam. http://maysoft.com/
Use Untangle (www.untangle.com)
I'm the IT manager for a company of about 40 people. We've used MXLogic (3rd party SaaS solution) for about 2 years now and I've been really happy with it. It is rare for spam to get through and equally rare for a legitimate email to get blocked. It can be configured to send a daily spam report to a user's inbox, so even if something does get blocked, they have an easy way to identify and release it.
Aside from the quality of the spam blocking itself, it also does AV scanning and offers all sorts of policy-based content filtering.
For a small company this has been a great solution. It was easy to set up, requires very little care and feeding, and it only costs us $60 per month. $60 a month to basically never have to think about spam is well worth the price IMO.
I host listservers for a national nonprofit organization. My server got blacklisted by AOL for a while because a few subscribers didn't realize they had joined a list. Instead of asking to be removed, they simply tagged the messages as spam at AOL. It didn't take long before we were suddenly considered a spamming server.
/etc/procmailrc for this.) If you're using SpamAssassin to filter, ignore most anything over 12. If you can, just send these to /dev/null or a quarantine mailbox.
Dealing with AOL over this was one of the more annoying problems I faced last year. Now the messages still get reported as spam, but because I've registered my server with AOL, they now ignore these reports.
Users really have little understanding of the nature of modern e-mail traffic. If they sit behind a decent filtering system, they see so little spam that they think most mail is legitimate. When I tell most people that spam constitutes well over 90% of all mail traffic, their jaws drop.
A couple of words of advice for the OP. Set up a system to funnel spams to individual spam folders. (I set global rules in
If you want to improve the visibility of your spam filtering operations, and perhaps get some recognition for, or help with, coping with spam, announce a "filtering holiday" in your organization. My recommendation would be to disable filtering over a weekend when most traffic is spam. When everyone arrives on Monday morning, it won't take more than a minute or two for them to realize what the spam problem is really like.
That suggestion is only partly made in jest.
I've been a big fan of the CanIt spam filter for years. It's underpinnings are OSS and you get full source code when you buy the product. Their support is excellent. At an ISP I run I installed it from source and it worked flawlessly. I would recommend the CanIt-SMB appliance for your needs unless you think you'll grow beyond 100 users soon. You won't be sorry.
Just implement gray listing. This will eliminate most spam. Then setup spamassassin to catch the few that do get through.
I set this combination up several years ago for a small company. The owner was about to abandon email entirely because of the amount of spam that was coming through. Once this combination had been implemented he has had no real problems with spam since.
When I first looked at the problem he was getting thousands of spam messages a day. Now there is just a handful that get through the gray listing and spamassassin does a great job of dealing with those.
I understand that this might not be a suitable suggestion for some organizations but many spam filter apps / appliances, will let an email (send regular schedule or as it comes in) to the users saying these emails were caught in the spam filter. would you like to release or delete. This would let you limit the time you spend on these emails and enable the user to access the spam filter only for themselves and allow the correct emails.
love the taste, hate the texture
Having deployed GFI at multiple locations, I suspect the problem is in your deployment. GFI provides learns spam patterns based on your inbound and outbound traffic, updates itself via downloaded lists, and allows users to report an item as spam to block further receipt of that message. Additionally, GFI's support has always been very responsive. Once client was using GFI MailEssentials when the PDF spam started being a problem. They had a patch a full week before the other vendors which I support. I suggest that you look at your GFI deployment and call their tech support to assist you in fixing it.
A third-party provider would typically be best for a small business, such as Postini. Appliances would be my second choice, such as Ironport or Ironmail on the high end. Whatever you choose, make sure that you integrate anti-virus and anti-spam in the same system.
I think you tend to get what you pay for. The open source solutions can work in some situations, but for one IT guy in a 50-person company, the maintenance could be a bit much. If you go this route, prepare to spend some time leaning to confugure the MTA and some trial and error.
You can present it to management from the perspective of, do we want to pay someone (you, in this case)to manage this full time, or do we want purchase a service from a spam filtering company, ironport, ironmail, barracuda, etc. who can do it for us. I love open source, but if you are spending all of your time working with spam. (which is terribly unrewarding) you only screwing yourself.
I couldn't agree more about ESVA. It is working like a champ for us. We don't get false positives, and spam is such a rare occurrence that when one of our users actually gets a spam every few months or so, they kind of panic and don't know what to do.
Like many others, I am concerned about the age of ESVA and the delays in getting 2.0 out the door. I am nearly at the point where I am going to start looking elsewhere. Perhaps IPCop and Copfilter on a dedicated firewall/anti-spam box.
This isn't the sig you're looking for...
This post sounds EXACTLY like my experience all the way to GFI sucking and letting through around 38% of spam mail. My company of 50 people gets around 15,000 messages a day and about a thousand of those are legit. I bought a Barracuda Spam Firewall 300 and in the first day I got users stopping by and thanking me (some people were getting 2-3k spam messages every day).
I've had it running for 26 days and after close to 400k messages and 25k legitimate it has blocked EVERY spam message. WELL WORTH THE PRICE!!!!!
Alt-N Technologies recently launched SecurityGateway for Exchange/SMTP Servers and it offers a feature that sends users a daily email identifying each message that has been qurantined. The user can then decide what needs to be done with the message and free you to manage more important areas of the network. You can watch a demo and download a free trial at http://www.altn.com/Products/SecurityGateway-Email-Firewall/. If you replace your current solution, I'll give you an introductory discount. You can contact me at kevin.beatty@altn.com
We've used Spamsoap for well over a year and have only good things to say about it. We route our mail feed to their servers and receive only fresh and spam-free email stream on our network. Sitting in the middle of thousands of customers' email feeds, they are in a better place to judge a message's spamminess than a local appliance or end-user application. Can't say enough about this service. We just signed the contract, wrote a reasonably-sized check, made a DNS change, and we no longer have a spam problem. No set up, no maintenance, no I am not an employee, stock-holder, or friend of their... just someone who likes the rare situation these days when something works exactly right.
I have no great love for Symantec, especially their retail products, but their Mail Security for Exchange (SMSE) has been fantastic for us. I believe it's based on the BrightMail engine they bought a few years ago, and they don't seem to have screwed it up yet.
After a Spamhaus RBL check, we still get ~20,000 spam messages a month (quite a bit for an office of 25 people.) I used to have a manually-maintained keyword / regexp list, which caught about 75% of this without much maintenance effort. After using SMSE for a few months I gave it up, since SMSE caught all of them but maybe 2-3 a day.
The detection rate is excellent, and I have yet to see a false positive that wasn't pretty close to spam anyway (legit hotel/airline offers and such.)
Your mileage will certainly vary (and will probably be less), but spam gives us very little trouble at this point. It's made my job easier, or at least allowed me to make better use of my time elsewhere.
I can't believe I just wrote glowing praise for a Symantec product, but there it is.
FIXME: Add a sig here
www.untangle.com
Untangle is essentially a GPL'd open source Linux distribution that acts as a perimeter firewall/spam filter.
Download the CD image and boot it an older system. This will give you a system at least as good as Baracuda (actually its a lot better) for FREE!
Gmail and Postini are not good solutions. Been there done that.
Facebook is billions of individual "Skinner Boxes." And if you use it you are the pigeon!
Give them a free trial try. They manage it all for you, take the stress out of the spam filtering.
Can't recommend them enough!
I'm also using gfi's mailessentials to handle the spam of my 100 users, and it does seem to be doing pretty well.
:)
I have enabled the autowhitelist which has reduced the amount of false positives from my system. Only emails coming from 'unknown' senders are scanned by gfi after I did this. This also allows me to tighten the rules a bit more without having the boss running after because of a lost deal.
I have currently enabled sbl-xbl.spamhaus.org and bl.spamcop.net, both of which seem to be doing a very good job.
Finally, I have configured all the anti-spam features to move the spam emails to folders in the users' mailboxes. I think this was my best move, considering the amount of spam we receive.
The route I took was to sign up for MessageLabs.
Previously the co I consulted for had half a dozen Exchange servers all running GFI mail scanning products. The Messagelabs solution (although its not free) saved a load of time, was reliable and reasonably (IMO) priced.
Might be worth a look.
We are currently using a combination of Postini, and Xwall. We're about ready to drop Postini as its really not doing much for us. Instead the Forefront stuff is looking interesting.
But Xwall has been a gem running as our edge roll server for the past 6 years.We have been very impressed with its light weight, power and extensive feature set. Its currently filtering against spamhaus and spamcop, but it also catches a LOT of virus emails that get through Postini. Since setting it to discard all emails to addresses outside our valid ones (aka- email addresses for employees that have left), the processing time has decreased significantly. Worth a look IMHO.
That is what I do for a small company with about a dozen email addresses. We setup SpamFilter from http://www.logsat.com/sfi-spam-filter.asp and I manually go in an clear out the quarantine items once a week. Sort by subject, and you can burn through a large queue very fast.
I'd recommend SpamFilter to anyone interested in a low cost solution with many advanced features. There is a free fully functional trial (no time limit) and it costs $600 for a one time server license. Works great, blocked 178,121 emails and forwarded 20,460 in the last 3 years.
SpamFilter Features:
DB - SpamFilter Distributed Blacklist
MAPS DNS RBL Filters
SURBL Filters
SPF - Sender Policy Framework
Bayesian Statistical Filtering
Image Scanning / Filtering
Blacklist IPs
Blacklist Domains
Blacklisted FROM Emails
Blacklisted TO Emails
Blacklist by Country
Honeypot Capabilities
Attachment Blocking
Keywords Filter
Reverse DNS validation
MX Record validation
Reject if "Mail From" = "Mail To"
Reject if "From Domain" = "To Domain"
Whitelist Domains / IPs
Deliver specific emails without filtering
Whitelist FROM Emails
List of "Authorized TO Emails"
SMTP User Authentication with SSL support
Why hasn't anyone suggested an outsourced solution like the gmail implementation of Google Apps for your domain? I don't work for google or own shares (ok, i own two) but think they have created a great solution for small business users. We've wrestled with spam filters, servers and email outages. It was a nightmare and very costly from sysadmin time every month. Finally I decided to throw in the towel to the fight to create an in house solution. It's been smooth sailing ever since. dont look back - let someone else take care of it.
If you're small/medium sized, and don't do a lot of email overseas, drop the IPs for Asia at your edge firewall.
Dropping the IPs for Eastern Bloc countries and Asia dropped my baseline spam from 400/day to about 80.
I manage email for 2600 users and after working my butt off for a few years trying to learn enough about spam and anti-spam... I finally learned that others are better at it than I, and that I have other work I like better.
so - my point...
try MX Logic - monthly billing based on the number of users in-house, EASY to begin using (simple DNS change) and if you find a better solution or spam really does go away... you're not invested so heavily that you feel bad about a change. They do a solid job. and I DON'T have to touch spam now.
Try it...
How do you know your ISP isn't doing the same thing? For the same reason people trust google -- you have a contract with them that says they won't.
You can put up your tinfoil hat, FUD like that doesn't fly here.
I manage a relatively simple solution for our small company of ~25 mailboxes (about a 2-3 spam/minute). We implement four layers of spam filtering, as follows:
1. We use an external filtering system that hooks in via DNS and prepends [SPAM] to the subject line of mails detected as spam.
2. We have a central whitelist of customer domains/emails that are allowed through.
3. Each user may use a web interface to implement more specific filtering that prevents the spams from reaching their desktop inbox.
4. Finally, each user has the option of desktop spam filtering, either within the mail application or through a desktop security system, such as Norton 360.
Not perfect, but it seem to catch 80-90% of spam before it reaches the users inbox.
James
The lack of updates has me concerned as well. ESVA just doesn't have the developer community working for it... hopefully it gets going again.