Microsoft Exchange and Blackberry Server Specialists

SEMblog

Microsoft Exchange Server and
Blackberry Enterprise Server news, views and fixes.

Anti Spam Product Selection

A common question that keeps coming up on forums and similar sites is "What is the best anti spam solution?"

Unfortunately there is no single answer to this question.
I usually respond with something like "What is the best car, best house, best wife?"

The only answer is that the best product is the one that works for you.
On most forums, most of the posters will have experience with one or two products, so will post that product X has worked well for them.
Someone else may well post and say that product X sucked and product Y was the best solution. Then another person will say, don't bother with a product, outsource it to service Z.

On my home network I have had good experience with Vamsoft ORF, but when I tried it on another site it was unsuccessful. I also tried GFI Mail Essentials at home, found it's performance wasn't great for me. However at another client it has been very successful.

When it comes to looking at antispam solutions, the key metric should not be how much spam does it remove, but how much legitimate email it blocks. If the product is stopping email you want from being delivered, then you need to look at a different product.

I have personal experience with this with a client a few years ago.

The client was a large finance company. They did loans and mortgages through brokers, many of whom used AOL and similar accounts.  (It will surprise you how many of the very small businesses like one man band brokers still do).
They have a requirement for zero false positives - because a single false positive could mean the loss of many thousands of pounds of business.
We evaluated every product on the market, from open source to high end commercial and out sourced solutions. The requirement was very strict - and every product failed because they were all blocking one or two messages a week that were legitimate.
It actually reached the point where we started to put a plan together to hire IT contractors whose sole responsibility was to go through the quarantine email manually, as it was worked out that they would only have to save one email every six months to make it worth while to the company. However in the end, one of the out sourced providers built a custom solution for them so that the management could be handed off.
 
The point I am trying to get across is that asking people what works for them and then using that for a buying decision isn't really a good idea. It does not allow you to bypass the evaluation period. Everyone knows that users don't like spam and no doubt as the administrator of the server you will be under pressure to find a solution that works. However purchasing in haste may actually end up costing your company money.

Most of the major products have evaluation versions you can download. Install them and run them in report only mode. See what it would catch. If you decide to start block messages, then quarantine them first so you can check for false positives.

You could find that the product that someone posts saying "We tried product X and it didn't catch a thing" actually works very well for you.

Real Time Blacklisting

Blacklisting.
For some email administrators Blacklists are the greatest weapon against spam. It cannot be denied that they can have a significant effect on the amount of email that your server has to process, and they do meet the primary objective of spam detection - dealing with the email at the point of delivery, therefore  reducing back scatter. They are also free, and once setup require little to no maintenance by the administrator.

However personally I dislike blacklists. I don't like the idea of someone else (either human or computer) deciding on what email I should receive, based on lists and reports that I have no control over.
Furthermore, from a business perspective, using a blacklist may cause potential clients to be rejected, as one of my specialism's is the cleanup of servers that have been abused and are likely to be blacklisted.

However, if I could blacklist IP addresses that I know are trying to send spam to me, in real time, where I have complete control over all aspects of the filter, then that could be something of use. A new feature in Vamsoft ORF has introduced exactly that, and has actually got to the point where I have turned off the antispam features in Exchange.

I have written about Vamsoft ORF before, using it for Greylisting (http://blog.sembee.co.uk/archive/2006/09/18/24.aspx) and as part of an SMTP gateway configuration (http://www.amset.info/exchange/gateway.asp).

With the latest version at the time of writing, 4.3, they have introduced a feature called Honey Pot. The simple way that this works is to block IP addresses that attempt to send email to addresses in the Honey Pot list.
In the Vamsoft setup guide it gives you some ideas on how to publish the honey pot addresses, however I found that I didn't need to publish anything.
Going through logs on my backup SMTP gateway, which does recipient validation through Vamsoft rather than Exchange, I noticed that the same non-valid addresses were being used time and time again. These were addresses that I had NEVER used, would never be likely to.

IMPORTANT: The use of addresses that have never been used is the key here. Adding addresses that were in use will provide you with false positives, because that could be legitimate email. If you decide to follow this practise then ensure that you only use addresses that have NEVER been used.

Therefore what I did was turn off recipient validation on my primary SMTP point of entry and configured  that function to be done by Vamsoft ORF. This allowed me to see the addresses that were being sent to on that server as well. I was then able to compile a list to use as my honey pot.
I review the logs frequently to see if new email addresses are being tried, which can be added to the list of honey pot addresses.

This means I am using three tests for spam - recipient validation (which should be something that every site does) greylisting, and honey pot.

The effect was significant. I have been using this setup for a number of weeks and the amount of spam I am seeing in my mailbox or caught by IMF (so got through the initial greylisting and honey pot) is almost zero. One or two messages a week. I have actually now turned off IMF on my Exchange servers.

Why is this being so effective?
The simple reason this is being so effective is that the spammer's list of email addresses will contain a mixture of valid and invalid addresses. As soon as the spammer's server attempts to send an email to a non-valid address that is on my honey pot list, it is blacklisted. Even if that IP address subsequently tries to send to a valid address it will be blocked.
Combined with greylisting, which sends away the initial connection, the even if a legitimate address is used first, the spam doesn't get though. The first attempt is greylisted, then if the list of email addresses contains one of the bogus ones, then it gets blocked. The server attempts to deliver again after greylisting and its connection is blocked.

I also think this is more effective than regular blacklisting because it is in real time and is based on email received by my servers.

I have combined this with an SQL backed database for Vamsoft ORF so that both of my SMTP gateways share the same information, meaning that a blacklisting that is set by one server, is also used by the other.

Finally, I have also combined this with custom NDR text, that points people to a special page on my web site. This page explains what is happening, and other ways to contact me. If required, I can then white list to allow the legitimate messages through and take the spam hit for a short time.


Vamsoft ORF: http://www.shareit.com/product.html?productid=169362&affiliateid=200023740