We operate a small Windows shop with Exchange. Spam is a constant problem; we ge

Question

We operate a small Windows shop with Exchange. Spam is a constant problem; we get thousands of spam messages a day and manage to remove most of the spam by using a filter on our incoming SMTP port. Still, some trash gets through. 1% of 10K spam messages per day is still really a pain.

We currently use Xwall as a spam filter. It has two really good features.

Graylisting (simply ignoring a first email from sites previously unseen; real mailers at such sites resend after a bit so such mail gets through, but spammers almost never resend). This catches 90% or more.
The ability to eliminate (spam) email by checking for certain string patterns using some simple wild string matches (text with asterisks for wildcards).

However, it isn't consistent in allowing pattern checks on any email field (notably we can't apply any filters to "From:" which the spammers seem to fill with lots of useful "I'm spam" indicators e.g., "From: Discounted Cars (Hilda.Pate@leaderRefreshing.com)". Nor does it allow powerful pattern matching (e.g., decent regexps). Absence of regexps means false positives and false negatives. We've complained to the Xwall guys about this for years but no response.

Is there a spam filter application that has:

Graylisting
Whitelisting with regexps on email addresses
Real regular expression filtering on all email fields, by field. Since regexp filters are invented to stop a particular wave of spam ("What has Martha Stewart done to her face?"), a really nice property would be termination date (default 90 days?) to let such filters age out with the capability to easily re-enable if the spam wave continues.
The ability to filter out email based on misspelled words (How many ways can you mis-spell "cialas" using funny characters for i and l?)
Recording of all incoming email in a log, with filtering reason (including "none")
Ability to designate a filtered-out email entry as "OK" to resubmit, to handle the occasional false positive

Other features such as Bayesian learning are nice to haves but not necessary.

Since such a filter accepts SMTP messages on a publicly visible SMTP port, and forwards (filtered) messages to an internal SMTP port that we provide for Exchange, it doesn't matter where it runs to us. In particular, it is acceptable for the filter to run on either Windows or Linux.

Our Exchange server is rather old (2005) and we're getting ready to upgrade. I'd be delighted to hear all this stuff is built into modern versions of Exchange. Pessimism abounds.

Explanation / Answer

Bayesian filtering is so millenium. ;) Honestly though, over the last five years the email industry has changed so much that it's nothing like it once was. Bayesian filters used to be the norm for filtering, and now they are very lightly used to only tag the most obvious offenders that are very clearly unsolicited messages.

IP Reputation is where you need to look, as most unsolicited messages come from bot networks filled with IP's that only ever send out a couple hundred spam messages and have no built up reputation so it's an easy spam flag.

Barracuda offers such a service, along with some others.

Honestly though - for what it's worth - move your email to a dedicated email provider. Unless it is critical for your email services to stay in house, it's not worth trying to keep it in house anymore. It's getting to the point where companies need to hire a team of email experts just to keep something like that in house as the maintenance required is getting further and further out of control.

Google would be my top choice, or Amazon. Google's antispam is quite frankly, amazing and false positives are relatively rare and the worst I usually miss out on is a newsletter that I legitimately signed up for.

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.