PDA

View Full Version : My three-tier spam solution


oheso
11-06-2009, 11:38 PM
I'm typically not too upset by spam, but it became more annoying when I started using my cell phone to read my mail (because I'm more likely to be interrupted from some non-computer task, only to find a spam message).

It's been pretty clear for a while that SpamAssassin is doing a very poor job generally. Replica watches and enhancement products come through with a score of 0 or 0.1.

After thinking about it for a while, I came up with a solution that works for me(1). I've been using it for about three weeks now and it's great. I call it my "three tier solution."

First, I have three mailboxes: main@example.com, no2@example.com and junk@example.com (for the purposes of illustration -- not my real mailboxes obviously). The one I'm interested in is main@example.com, and mostly what I get here (in terms of legitimate mail) is mail from my friends and a short list of known clients. In other words, a perfect white listing opportunity.

So, after some fiddling around, I figured out the thing to do with main@example.com was remove SpamAssassin entirely(2) and go with a filter checking against a white list. Anything not on the white list gets redirected to no2@example.com.

no2@example.com has SpamAssassin enabled. I do not check this account via my cellphone. I check it at the office (and I have it set to only poll the server once every 30 minutes). Anything that SpamAssassin thinks is spam then gets redirected to junk@example.com.

Sometimes I check junk@example.com via Quest Mail for false positives, but I usually don't bother.

Results after about three weeks: very good. I only get stuff at main@example.com (and hence my cell phone) from my white list. My friends and some select clients.

no2@example.com is about 40% people I forgot to whitelist, and universities. (My son has good SAT scores, so we're hearing from a lot of universities.) The other 60% is junk, plain and simple. Mostly these days it's replica watches and diplomas (nice overlap there with the universities).

That might make it sound like SpamAssassin is doing a terrible job, but remember I've stacked the deck against it. It's only filtering stuff that isn't on my white list; i.e., probably 99% of what makes it to this step is already junk.

The first few days I was religiously checking junk@example.com for false positives. There have been none. It's still possible, so I shouldn't get lazy. But it's just too easy to ignore this mailbox and zero it out every so often.

Notes:
1. Why this works for me: I have a pretty well defined list of correspondents for main@example.com. If you have a mailbox that you're using for initial sales contacts (info@example.com, for example) or if you're in a job search and want to hear from potential employers even if you've never heard of them before, this approach will probably not be good for you.

Also, I do not forward main@example.com to an outside host (gmail, etc.). So I don't have to worry about spamming someone else by not having SpamAssassin enabled on main@example.com.

I'm now happy enough with this approach that I'm thinking of removing some mailing lists from my white list. I can read them at no2@example.com during the day, so I don't need them appearing on my cell phone in the evening.

2. I tried working with SpamAssassin's white list feature for main@example.com. The problem was that when a message was passed to no2@example.com it would be immediately redirected to junk@example.com. SpamAssassin on no2@example.com would see that SpamAssassin on main@example.com had already rejected the message, so it would reject it, too. I could only get stuff to stick in no2@example.com by turning off SpamAssassin on main@example.com and using a rule-based white list.

hobbes
11-07-2009, 07:19 AM
So oheso, the only bits you left out:

1. How big is your whitelist?

2. What SA score are you using?

Given the # of emails I receive from unknown parties, I take the 2-step approach. SA with white-list (from addresses and to unpublished addresses) and a score of ~3.4. Yes, I've been getting some spam messages, lots more in recent weeks, but find that keeping up with it in the inbox is manageable. Any SA-detected spam goes into a spam mailbox that I check every few days or when it's getting around 3-4,000 messages.

I can see however where for use with a cell phone, your approach may be preferable.

oheso
11-08-2009, 12:07 AM
Hobbes, in order:

1. My whitelist is about 50 lines. I've written it so a partial match is the same as a full match, so I can easily whitelist a domain as an individual address.

2. I had been using a score of 3.0 on my main address, and was getting too much spam (for my taste, with my cellphone). When I started looking into it, though (as mentioned above), a lot of what I thought was really obvious spam was getting a 0 or 0.1 score. That made it pretty obvious that the spammers are a step or two ahead of SpamAssassin. I'm now using a score of 3.0 on no2@example.com.

What I didn't mention was this approach leaves me wide open to spam that's spoofed from addresses on my white list. I'm not doing any testing of spoofed from addresses. But then, from what I've seen, SpamAssassin doesn't score a spoofed from very highly either.

Henning
11-09-2009, 05:44 PM
This sounds nice, but I have too many customers with my “main” email address that it is difficult to implement.

SpamAssassin is not working for me either. I receive around 300 spam emails daily which are almost in 90% easily filtered out by my Outlook, falling in the junk mail folder. Why can’t SpamAssassin do this?

Anyway, I also would like to download my emails in my phone, but it impossible with all this spam.

Does anybody know of a good antispam filter I could implement inside my futurequest account and bypass SpamAssassin?

Thanks

Henning

Buck
11-10-2009, 10:45 AM
I use IpN which runs beautifully on FQ servers.

Honestly, I don't get SPAM anymore on any of the 25+ accounts I have between a few different domains. Not to say that the level of SPAM is manageable, I literally don't get SPAM at any of my e-mail clients. The IpN filter eliminates all of it.

Henning
11-10-2009, 10:56 AM
Thats what I need, IpN How does it work? Where could I find it?

Thanks

frankc
11-12-2009, 10:22 AM
Just yesterday I began using SPAMfighter http://www.spamfighter.com/Community_Default_Trial.asp . It's installed as the Pro version and reverts to the free version after 30 days and no registration. After just two days I'm VERY impressed.

Buck
11-12-2009, 11:54 AM
IpNation comes pre-configured to block/exterminate
everything from the worst non-USA spam-spewing nations, including China,
Brazil, Turkey, et al. You work through some initial setups that are pretty easy, then start off tagging messages to help the filter learn what's good & what's not.

Visit www.ipnation.org for details. You can see that whereas SpamAssassin runs around 70-77% effective, IpNation generally runs around 99.7 to 99.9% effective.