Admins. what's your spam solution?

M

Mister Natural

2[H]4U
Joined
Oct 10, 2002
Messages
3,441
I'd like some feedback from others on how they deal with spam. Specifically if they allow users to manage their own email. We have filtering at the server level but it is becoming too much to handle for our I.T. department. We don't run an exchange server, we don't have the personnel to do that. We have an ISP that does web and email hosting. Their spam filter is unreliable. I'm considering turning off the filter at the server level and letting users deal with their own spam.
 
You realize that by turning off the spam filter you may be increasing your work load if one of the peons decides to infect the whole company with a virus :)
 
Trepidati0n said:
You realize that by turning off the spam filter you may be increasing your work load if one of the peons decides to infect the whole company with a virus :)
Click to expand...

yes, it's a great concern. That's why I'm interested in how others are dealing with the issue. The barracuda device would not apply to our situation since we do not have an email server on site.
 
I have all of our email go through an outside vendor ( Securence ) before it gets near my network.
It stops 99% of all our spam with very few false positives.
 
Use an outside vendor as well. MXLogic, blocked close to 900k pieces of spam in July from ever hitting our servers.
 
so far this month for a company of 20 employees Securence reports:

143,089 total emails
5,165 (3.61%) clean emails
297 ( 0.21%) virus
93 (0.06% ) phishing
137,534 (96.12%) spam
 
We use a system called "Dspam", its a learning filter, each individual user reports messages as either spam or innocent. The filter learns from these messages, there for it is tailored to each user.
 
Thanks gang, keep them coming. I will look at all the recommendations. My biggest concern is false positives. It's really our biggest problem with what we use now.

I'm not familiar with these suggestions until I look into them. But I gather that some of the devices you are suggesting would be a device similar to a firewall which can scan mail ports coming past our router/firewall even though we are using an ISP and do not have an exchange server. Or some type of 3rd party vendor which our mail temporarily gets redirected to before reaching inboxes.
 
We have:

zen.spamhaus.org
Greylisting
Spamassassin
A/V
Block dangerous attachments

So far our spam load looks like this:

Total emails blocked by the greylist: 11538
Total emails blocked by Spamassassin: 3860
Total connections rejected due to Spamhaus: 42437
Total connections rejected due to Pregreet traffic: 3277
Legitimate Traffic: 5291

That's just for this week ( which still has a full day left ).
 
We use a company called Appriver. When spam arrives on our end, the user forwards the message to [email protected] and all is well. I'm not worried about spammers spamming this address as it will get blocked, or at least get in the block list. The more spam blocked, the better for our end users :)
 
Here is our report page from May when we had a virus attack starting May 1st.

You can click on the links and break down everything into what virus the emails contained and what filer blocked them. Same thing with spam and phishing. It will tell you what phishing scams are being sent to you, etc.

The best thing for us is that they had all of the greeting card spam blocked before we even started getting them. I'll say it again, they block 99%+ of our spam and it requires 0 work on my part and is completely transparent to the users.

email.jpg
 
Thanks again for all the replies. I've contacted Securance. I was quite surprised that it was very affordable from a corporate perspective. As a result we're going to check it out right away. Going this route is preferred so that we don't have another piece of hardware to manage in the office.
 
As long as corporate policy has no issues with outsourcing the Anti-Spam, it's a good bet.

Trend for SMB and RDNSBL' on Exchnage here. Works so-so.

Old job had Surf Control and it rocked
 
Unfortunately it looks like we will not be able to use Securence. There is an issue with the way our web host has their email servers configured. They aren't being very co-operative either, but some of the issues are because they have a cluster of email servers and they have dynamic IP addresses among other things. I made a change to our MX record to point to Securence servers and we stopped receiving email altogether. It went into a loop between the 2 locations until I changed the MX record back to it's original setting.

Guess I'll be looking at other options again. It's a shame, from what I saw I liked the Securence interface and think it would have worked well for us. :mad:
 
Unfortunately I cant comment on the cost as that is another department but we use a program called MailMarshal. I do apologise if it is horrendously expensive though. It seems pretty good, a few have been slipping through lately but is very customisable and gives users the option of releasing the emails themselves if they want them.

I think it stopped somewhere in the region of 5,000 spam emails last wednesday when I was checking the stats, I think we only had 15,000 geniune emails.
 
YOStonecat, I checked out untangle today. Pretty cool stuff for open source. I was just beginning to think this might do the trick when I discovered I can't quarantine emails unless I have an exchange server in house. As a matter of fact a lot of scenarios and solutions I've been looking at all point to having an in house server.

After some discussion with the I.T. director it was decided that our company prefers to not keep an email server in house mainly due to the new email retention policy laws. If we don't have an email server we can't be held responsible for retaining those emails.

Looks like my only option at this point is to find a new email host that will work with Securence or have similar spam/phishing security features.
 
We use www.swirbo.com. They are pretty good and cheap. I have tried postini and barracuda. For a lot less, Swirbo does a better job. If you must have a fancy UI, then swirbo might not be the answer but they do great spam filtering.
 
Mister Natural said:
After some discussion with the I.T. director it was decided that our company prefers to not keep an email server in house mainly due to the new email retention policy laws. If we don't have an email server we can't be held responsible for retaining those emails.
Click to expand...

That's completely wrong, your record keeping responsibility simply moves from one server to dozens of desktops instead.
 
I figured someone would say that. Fact of the matter is the I.T. department and organization can't be held accountable if a user deletes an email and we don't have a server which originally held the email. I'm not a lawyer, but that's how our lawyers explained it to me. Our company is involved in lawsuits all the time and it's held up so far.

/threadjack
 
Just got off the phone with Securence. I was very impressed with what I saw and I am doing a 30 day demo for my company. They do everything I want that Swirbo doesnt do, but the true test is to see if their filtering is as good as Swirbo.
 
Yeah I have an option open with them still. They can actually host email through their parent company US Internet and we can use Securence with their hosting service. I'm awaiting word back from one of our consultants on some options before we move forward.
 
I know I'm a few days late, but Barracuda here! (also at multiple customer locations)

We had to do a run down on multiple spam filters for a client of ours, barracuda was the clear winner. They have not been disappointed either.
 
We have a server level spam/virus/content filted which tends to block around 95% of spam however, many of our mailing lists are signed up for spam and unfortunately, stuff gets through. For users, we offer SpamAssassin. Hope this helps.
 
I use a Barracuda 300. The price is right. I think my last renewal was $900 for 3 years. Just today, at 8:30AM... 23,593 total. Only 277 allowed.

Edit: Bleh, the formatting didn't hold. Removed full stats.
 
Barracuda for the university I work for. Having several thousands students, the Barracuda's lack of per-user licensing makes it a very affordable solution. And it works great.
 
You must log in or register to reply here.
Back
Top