Postini-like anti-spam services

Adam, are you able to share with us what this is costing you per month?

I looked through the website, and they don't show prices, but have a
feedback form. I'm curious about whether it's worth it for a small (<
10) user server like myself.

[digital.forest resells the Postini service for $1 per account per month. And you don't pay for accounts that are just aliases (adamtidbits.com just points at acetidbits.com, for instance, and you can set accounts to be unfiltered, at which point you don't pay for them either. Honestly, I don't know exactly what's involved with signing up with digital.forest, though Chuck may chime in here. I'll figure that out for when I write the review. -Adam]

Cheers,
Nick

--- begin forwarded text

From: Mark Burrows <markgeekspeak.net>
To: acetidbits.com
Date: Mon, 5 Jul 2004 23:11:46 -0700

I wanted to let you know that our local ISP, Sopris Surfers
(http://www.sopris.net) , tried Postini for several years and finally
gave it up in favor of Mail Armory.

Programs placed on the server side that are designed to "capture"
spam all use the same formula as far as I can see. There is very
little difference between Postini and Mail Armory except that Postini
had a limited amount of "recipients that could be set up so as not to
be filtered automatically (and Postini ALWAYS caught legitimate mail)
It handled list mail even worse. Plus the drudge work of being on the
dial up side and going through my Postini interface at 25 messages
per page with 200 plus spams hitting me per day was painful. Even
when I got DSL it didn't improve much.

After a year of that nonsense I started to rely heavily on Eudora for
it's filtering capabilities, simply because I can scan my mail faster
from my laptop HD than I can using an HTML interface. Even with
Eudora's much improved spam filtering and it's need to get a lot
better, it's still better than Postini.

Mail Armory however has 100 messages per page and an unlimited amount
of allowed recipients, but the bonus part is that it has captured no
legitimate mail and a good majority of my spam. I just went through
364 messages and none of them were off the mark.

Now it may sound strange that I used to use it and now rely on Eudora
but still using Mail Armory. I have 8 accounts I get mail from not
all of which come through the local POP. My local account had grown
so useless due to spam that I never check it anymore. But with Mail
Armory and it's results I may have new life breathed into an old
email address.

Thanks for constantly creating a great newsletter for Mac fans everywhere.

Mark Burrows

--
GeekSpeak can be heard every Monday on KDNK 12noon to 1pm and The
Geek can be reached through his website at www.geekspeak.net or by
writing to markgeekspeak.net

--- end forwarded text

>Adam, are you able to share with us what this is costing you per month?
>
>I looked through the website, and they don't show prices, but have a
>feedback form. I'm curious about whether it's worth it for a small
>(< 10) user server like myself.
>
>[digital.forest resells the Postini service for $1 per account per
>month. And you don't pay for accounts that are just aliases
>(adamtidbits.com just points at acetidbits.com, for instance, and
>you can set accounts to be unfiltered, at which point you don't pay
>for them either. Honestly, I don't know exactly what's involved with
>signing up with digital.forest, though Chuck may chime in here. I'll
>figure that out for when I write the review. -Adam]

Chiming in as requested.

I seem to recall pricing on Postini's site at one time... I'll go
poke around and see if I can find it. If so, I'll post a URL.

I will say that it is priced for volume purchasers. It is really
designed for enterprises or ISPs, so IIRC the pricing for smaller
volume customers is quite high (like between $5-$10 per account, per
month for organizations under 100 users.) I may be way off on that
number, as it has been three years since I looked at their pricing.

Adam is right, in that we charge our clients $1 per account per
month. We are probably NOT making much margin on that as we likely
lose most in just performing the accounting and billing (which can be
a huge PITA). Plus I'd say well over 80% of our billing issues
surround Postini. It is funny how if you charge somebody for $700
worth of colocation/bandwitdh they don't blink, but they'll freak out
over an extra $5 service... go figure. The extra layer of
administration is tough for clients to grasp sometimes, as we have
clients who self-administer their mail with us, but Postini's admin
interface is too obtuse for them to deal with. As such we spend a lot
of time doing monthly manual administrivia of Postini configs on
behalf of our clients.

Our PRIMARY motivation for adopting Postini was to guard our
mailservers against the large-scale dictionary (aka "Directory
Harvest") attacks that were crippling server performance for us circa
2001. Given that our mailservers handle MX for about 12,000 to 16,000
domains they were big-time targets for such attacks, and they reduced
the usefulness of our servers to nil. Ask anyone who has been on the
business-end of a Denial of Service attack: it is *not* fun. About
half our clients have opted to NOT use Postini filtering, which is
fine with us, because we are still protected by Postini's
attack-detection and blocking service, even if they aren't filtering
for all domains. The added benefit of being about 95+% Spam and 100%
(mail-borne) virus free is just icing on the cake really.

Initially we added Postini as an "extra" service for our clients,
after testing it for our own domains. About 8 months later we made it
sort of "mandatory" to hide our servers from the address harvesters.

Postini is NOT the "FUSSP" (Final Ultimate Solution to the Spam
Problem*) by any stretch of the imagination. It is a PITA to set up
and tweak to work to your own individual needs... however, it allows
one to side-step the vast majority of the spam problem and live in
relative peace and comfort until the battle is over. Mostly it allows
anyone who operates a mail server to let it do the job it was
designed for, instead of having to churn and burn cycles sorting
through the 50-60% of worthless stuff that passes as mail nowadays.

Postini is also not the only, nor can it possibly be the "best"
solution out there. It is just the one we stumbled upon and are quite
happy with so far. We have another client (You know who you are
Mark!Hurry up already!) is about to test-drive a "Barracuda Anti-Spam
appliance" for their mail servers in our datacenter
<http://www.barracudanetworks.com/>. I am *very* interested to see
how well it works, as I have heard good things about it, but have yet
to see one in action myself.

As I told Adam when he started this experiment, it may take more than
a month to really appreciate how well Postini works. The initial
setup and configuration, and creating the lists of exceptions and
whatnot can be a bit frustrating. But, speaking as somebody who has
been using it now for three years, I don't even think about it
anymore... it just works, and works quite well.

--
Chuck Goolsbee V.P. Technical Operations
_________________________________________________________________
digital.forest Phone: +1-877-720-0483, x2001
where Internet solutions grow Int'l: +1-425-483-0483
19515 North Creek Parkway Fax: +1-425-482-6871
Suite 208 http://www.forest.net
Bothell, WA 98011 email: cgforest.net

* Some FUSSP Humor: <http://www.rhyolite.com/anti-spam/you-might-be.html>

--- begin forwarded text
From: ANRED <jarinorrio.com>

My ISP has recently implemented MX Logic's Email Defense System
<http://www.mxlogic.com/>. Once I trained it to let my newsletters
get through, it reduced my spam load from 300-400 per day down to
five or six per day. I get a report every 24 hours if I want to check
for mistakes. So far there has been only one in the past six weeks.

It would be interesting to compare this system to Postini.

Jay
jarinorrio.com

--- end forwarded text

I'm still looking for the perfect anti-spam service for our domain (10 users). I am using Mailblocks, a challenge/response system, and the major flaw is that the challenge message sent to people trying to email me often gets blocked by their own spam filter. Even .mac's servers block them, I have tested this myself. Kinda defeats the whole system (I have to check blocked messsages, but I don't get any spam).

So here are my requirements for the perfect system; I'd be interested in comments, other desired features, and if anyone has found such service:

Preemptive, server side filter

IMAP Server - I check mail from phone, etc.

Spam scoring/sorting - makes it easier to check for false +

Web mail access - Handy for travel

Can import addresses

Shortcut to add name/domain from blocked message

User definable Rules

And of course, it has to work

----- Original Message -----
>From: jim431 <jimhemostat.com> Date: Thu, 12 Aug 2004 14:09:20 -0700

>I'm still looking for the perfect anti-spam service for our domain
(10 users). I am using >Mailblocks, a challenge/response system, and
the major flaw is that the challenge message >sent to people trying to
email me often gets blocked by their own spam filter. Even .mac's
>servers block them, I have tested this myself. Kinda defeats the
whole system (I have to >check blocked messsages, but I don't get any
spam).

I won't comment on the "Prove you love me" aspects of Mailblocks
except to say C/R is evil and I don't think I have _ever_ responded to
one.

SpamAssassin 3.0 and greylisting have reduced the spam on my server to
a trickle. The vast majority of spam is blocked at the MTA with
greylisting or the SBL blocklist. The few that get delivered (less
than 8% of the total attempts) get tagged with astonishing efficiency.
 I've had less than 0.1% false negatives (Spam that is not tagged)
since Installing SA3 and the very few false positives where spam
discussion messages that included complete spams.

>IMAP Server - I check mail from phone, etc.

I use postfix+SA+postgrey and uw-imap

<http://www.postfix.org>
<http://www.spamassassin.org>
<http://isg.ee.ethz.ch/tools/postgrey/>
<http://www.washington.edu/imap/>

>Web mail access - Handy for travel

I use squirrelmail for webmail.

<http://squirrelmail.org/>

--
 ::::== <http://www.kreme.com> ==::::
 :: Don't get saucy with me, Bernaise ::

SpamAssassin 3.0 and greylisting have reduced the spam on my server to a trickle.

Thanks, Lewis. Our mail server offers SA, I just have to configure procmail. The SA site seems to have some good tutorials. I'll try it out.

Jim

At 8:35 PM -0700 7/13/04, chuck goolsbee wrote:
>We have another client (You know who you are Mark!Hurry up already!)
>is about to test-drive a "Barracuda Anti-Spam appliance" for their
>mail servers in our datacenter <http://www.barracudanetworks.com/>.
>I am *very* interested to see how well it works, as I have heard
>good things about it, but have yet to see one in action myself.

We are currently evaluating a Barracuda 400 appliance. So far the
results are remarkably positive. Our mail admins are used to slicing
and dicing sendmail configurations, and so far their only beef is
that it's so, well, appliance-like. There web UI isn't clear in some
areas, but that's a minor issue and can (relatively) easily be fixed.
(We plan to install the 3.0 software in short order.)

I added it to my mail flow yesterday, and after a couple of fiddles
with personal settings, only a trickle of spam (perhaps three
messages in total made it to my Inbox - and those were efficiently
dispatched by Eudora's SpamWatch. My settings are: Tag=3,
Quarantine=4, Block=8. No false positives yet.

So far, this user likes it quite a bit.

--
Andrew Laurence atlaurenuci.edu
Central Computing & Security http://www.nacs.uci.edu/~atlauren/
Network & Academic Computing Svcs.
University of California, Irvine

At 2:15 PM -0700 8/17/04, Andrew Laurence wrote:
>At 8:35 PM -0700 7/13/04, chuck goolsbee wrote:
>>We have another client (You know who you are Mark!Hurry up
>>already!) is about to test-drive a "Barracuda Anti-Spam appliance"
>>for their mail servers in our datacenter
>><http://www.barracudanetworks.com/>. I am *very* interested to see
>>how well it works, as I have heard good things about it, but have
>>yet to see one in action myself.

I have a Barracuda 300 and I have never had so many people in my
office thank me. It has really reduced our spam. It is simple to use.
It uses multiple approaches for identifying spam. I get anti-spam and
anti-virus updates every day.

Keep in mind that the Barracuda has an annual cost on top of the
purchase price if you want the automatic updates. And look carefully
at the different models. We picked the 300 over the 200 because it
allows for some user self-management.
--
  Paul Chernoff
  Director of Information Technology
  Washingtonian Magazine
  202-296-3600
  pchernoffwashingtonian.com

jim431 wrote:

>So here are my requirements for the perfect system; I'd be interested
>in comments, other desired features, and if anyone has found such
>service:

We've been pretty happy with Tuffmail hosting. We have a 15 user system
without a real admin, so doing it ourselves seemed like more than we
wanted to learn vs. about $200/year.:

<http://www.tuffmail.com//

>Preemptive, server side filter
>Spam scoring/sorting - makes it easier to check for false +

They have SpamAssassin, MX restrictions that are settable on a per
mailbox basis and a Bayesian filter that is tunable on a per mailbox
basis. You can also set up server side mail rules which filter into
different IMAP mailboxes on the server and are thus constant across
whichever client you use.

For example, if SpamAssassin catches something that the Bayesian filter
misses I flag it on the server to consider it for training the filter.

You can also set two levels of Spam score to quarantine the messages on
the server. This makes acess via Treo etc... much more realistic. All
of this is per account.

>IMAP Server - I check mail from phone, etc.

Both IMAP and POP.

>Web mail access - Handy for travel

They offer both Horde IMP and SquirrelMail

>Can import addresses

Do you mean to the webmail client? If so IMP can do this. If you mean
for spam allowing/blocking you can set allow/deny lists at the account,
address or MX level.

>Shortcut to add name/domain from blocked message

Not that I see.

>User definable Rules

Both mail filters and spam blocking.

Overall it manages spam well and is flexible enough to handle lots of
different user styles. For example, people that use only a POP client
like Mailsmith will set it to only filter the most obvious spam (scoring
over 15 in SpamAssassin for example) into a folder that is left on the
server. The rest goes to their Inbox, is fetched with a POP client and
run through POPFile. They see almost no Spam, and the server side
filtering is good enough that the inbox stays clean for use on a Treo.
And they can keep Mailsmith which doesn't do IMAP.

People using IMAP clients will set the server side Spam quarantine a
little more aggressively since they have access to all the server
folders.

--Ware

Our school is using Barracuda anti-spam filtering. It catches about
80% of my incoming spam at the mail server, with no false positives.
That still leaves me with maybe 20-30 pieces of spam a day to deal
with. I'm using SpamSieve on those in Eudora, but for some reason the
latest upgrade for Eudora 6 seems over-eager and is labeling as junk
a lot of my legitimate mail. The earlier version of SpamSieve worked
pretty well, but now I'm having to start training all over again.
--
Paul Brians
Professor of English
Director of Undergraduate Studies
Department of English
Washington State University
Pullman, WA 99164-2050
http://www.wsu.edu/~brians/

We've been pretty happy with Tuffmail hosting. We have a 15 user system without a real admin, so doing it ourselves seemed like more than we wanted to learn vs. about $200/year

Thanks for the tip, they look like a good option. They are more expensive than our current web/mail host, and they only do mail, but they seem to have a lot more to offer. At any rate $200/year is still cheap, I'll check it out.

Thanks in part to the discussions here, I have sworn off the challenge/response solution after 6 months on Mailblocks (and 32,132 blocked messsages). Too many false positives, lost emails and bad karma (sort like of polluting the Net). I have set up SpamAssassin with some help from our hosting service, and so far it seems to work well.