manfred
03-01-2010, 04:25 AM
Today, I want to write down a few words about a spamfilter, which did made my life much easier. Normaly I don't write such Testimonial, but now I MUST do it. :)
Until three months ago I had also a big problem with spam. I had activated Spamassassin, EFM and the "received line" IP-address filter to stop the flood of spam.
All of this antispam software and technique is good but not good enough.
Spamassassin: Good if you can manage and tweak the config. If you are on a shared host, you can't change the config. You can only tweak the cut-off-score and do some whitelisting. But, what to do if you whitelisted your own domain and the sender forged any email address at your domain? I think 99% of the spam mails do have forged sender addresses.
EFM: You have to edit the "banned word" lists on a daily base.
Examples: V1agra, V1@gra,.. Pills, P_i_lls,... and so on
"received line" built-in filter: Nice and effective. But, how do you block an IP-range if your customer is within this range? Block every single IP-address? My "blocked-IP list" was three A4 sites long.
And now the best question. Delete, Tag, Redirect or Bounce the email?
Delete: What is if the filter deletes a good mail?
Tag: No email lost, but you still have to review the tagged messages.
Redirect: see "Tag"
Bounce: STRICTLY NO! Innocent people get the bounced emails, and maybe your emailserver will be blocked.
You can kill a big amount of spam, but you will also kill good emails and you will still receive spam. For this reason I started to search the www for a better (effective) solution. Greylisting, software to install locally on your desktop computer,...
And then I found IpNation! I read the introduction and wrote an email to the developer (a FQ customer) to become a volunteer. Only a few hours later, I was a "Padawan Learner" for this incredible effective spamfilter.
I only can say, try it and love it.
The filter also does have a remailing function to remail killed ham (false positives). !! No email is lost !!
Each email is saved to one of four daily log files on the server by the filter. You download all the data files with the provided viewer software and start the so called "Friends Finder". Now the viewer is doing what it has to do, find the good emails, the false positives and ask you if some (just a very few!) emails are spam or ham.
If a good email was killed, you can simply hit a button to remail it. The viewer takes the original email, uploads it to the server and the remailer software puts it directly back into the email queue. So, you can see, no email is lost.
Some more important points:
1. The "Friends Finder" tool takes most of the tedium AND risk out of searching for False Positives
2. We all contribute our low scoring spam which means we can more rapidly create and deploy new rules
3. It comes with a complete "IP-to-Nation" data file, and a set of pre-defined "kill worthy" nations
The developer and the IpN community will help you through the installation and configuration process.
Where can you find this incredible tool?
At http://www.IpNation.org (http://www.ipnation.org/)
-Manfred
--Die Spam, die! :)
P.S.: The filter is also for non english users. I'm sitting here in the heart of Europe, Austria, and it works perfect against french, russia, english and german spam.
Until three months ago I had also a big problem with spam. I had activated Spamassassin, EFM and the "received line" IP-address filter to stop the flood of spam.
All of this antispam software and technique is good but not good enough.
Spamassassin: Good if you can manage and tweak the config. If you are on a shared host, you can't change the config. You can only tweak the cut-off-score and do some whitelisting. But, what to do if you whitelisted your own domain and the sender forged any email address at your domain? I think 99% of the spam mails do have forged sender addresses.
EFM: You have to edit the "banned word" lists on a daily base.
Examples: V1agra, V1@gra,.. Pills, P_i_lls,... and so on
"received line" built-in filter: Nice and effective. But, how do you block an IP-range if your customer is within this range? Block every single IP-address? My "blocked-IP list" was three A4 sites long.
And now the best question. Delete, Tag, Redirect or Bounce the email?
Delete: What is if the filter deletes a good mail?
Tag: No email lost, but you still have to review the tagged messages.
Redirect: see "Tag"
Bounce: STRICTLY NO! Innocent people get the bounced emails, and maybe your emailserver will be blocked.
You can kill a big amount of spam, but you will also kill good emails and you will still receive spam. For this reason I started to search the www for a better (effective) solution. Greylisting, software to install locally on your desktop computer,...
And then I found IpNation! I read the introduction and wrote an email to the developer (a FQ customer) to become a volunteer. Only a few hours later, I was a "Padawan Learner" for this incredible effective spamfilter.
I only can say, try it and love it.
The filter also does have a remailing function to remail killed ham (false positives). !! No email is lost !!
Each email is saved to one of four daily log files on the server by the filter. You download all the data files with the provided viewer software and start the so called "Friends Finder". Now the viewer is doing what it has to do, find the good emails, the false positives and ask you if some (just a very few!) emails are spam or ham.
If a good email was killed, you can simply hit a button to remail it. The viewer takes the original email, uploads it to the server and the remailer software puts it directly back into the email queue. So, you can see, no email is lost.
Some more important points:
1. The "Friends Finder" tool takes most of the tedium AND risk out of searching for False Positives
2. We all contribute our low scoring spam which means we can more rapidly create and deploy new rules
3. It comes with a complete "IP-to-Nation" data file, and a set of pre-defined "kill worthy" nations
The developer and the IpN community will help you through the installation and configuration process.
Where can you find this incredible tool?
At http://www.IpNation.org (http://www.ipnation.org/)
-Manfred
--Die Spam, die! :)
P.S.: The filter is also for non english users. I'm sitting here in the heart of Europe, Austria, and it works perfect against french, russia, english and german spam.