Anti-spam measures we use

Here's an email I just sent out today to all our Hong Kong staff regarding spam reduction measures (note that I'm not using our real address below to prevent "spam bots" from harvesting our address):

Hi all,

JFYI...

We have a "content-based" anti-spam filter on our mail server that has been in use since Feb 2002 and currently blocks about 175 spam messages a day. ("Spam" = "junk mail")

From last Thursday, I installed 3 new anti-spam filters that use "DNSbls" (Domain Name System-based "blacklists"). These have been blocking around 350 spam messages per day so many of you may have noticed a decrease in the number of spam messages you receive.

As with any anti-spam measure, some (but very, very few) legitimate messages may get rejected by our server. (These are called "false-positives".) If any legitimate sender (non-spammer) has their message rejected by our server, they will receive a return-error message like this:

550 5.7.1 If your message was wrongly rejected, please EMAIL help@ourdomain.com. A real person will get back to you within 8 hours to help. Your mail server is on the SpamCop blocking list (http://spamcop.net/bl.shtml).

If they read the message, they can easily mail help@ourdomain.com and I will help them get their message delivered successfully.

If anyone complains of difficulty in sending email to you, just email me and I will help.

Let me know if you have any questions or concerns.

The content-based anti-spam filter I talk about is SimpleText Filter for the Mac-based EIMS mail server software we use. Here are the DNSbls I've installed:

1. BL.SPAMCOP.NET
2. BLACKHOLES.EASYNET.NL
3. DNSBL.NJABL.ORG

SpamCop also offers a cool spam reporting service. You sign up for an account (free or paid) and they give you a unique email address and Web site address from which you use to submit spam with. I submit spam using the email method and an AppleScript for Eudora makes it a slick one-step process. For each spam you submit, SpamCop emails you back providing you with a link to a Web page that shows you detailed technical analysis (example) of the spam you submitted (system uses DNS and whois lookups and I think some sort of fuzzy logic). At the bottom of that Web page, you have to then click the Submit button to send the report to the appropriate parties identified. Pretty nifty!

Posted by derek at June 11, 2003 11:43 PM