Anti-Spam Solutions

[geekgurl]

I am trying to evaluate some anti-spam solutions for work and wanted to get some real world feedback on what people are using and how it's working for them. I'm looking at the typical software products Brightmail, Surfcontrol, Superscout and so on but am open to appliances as well. This is a mixed environment Windows/*nix so i'm not platform dependant but we are using Exchange 2000. I am not wanting to install anything on that server for obvious reasons. Also, we want don't want a client side solution, that would just mean more for me to support and i already have more than enough there.

Thanks in advance for any input.
gg

[TheCotMan]

I am trying to evaluate some anti-spam solutions for work and wanted to get some real world feedback on what people are using and how it's working for them. I'm looking at the typical software products Brightmail, Surfcontrol, Superscout and so on but am open to appliances as well. This is a mixed environment Windows/*nix so i'm not platform dependant but we are using Exchange 2000. I am not wanting to install anything on that server for obvious reasons. Also, we want don't want a client side solution, that would just mean more for me to support and i already have more than enough there.

SpamAssassin with custom rules that include:
Blacklisting of domains (This is a heavy on-going cost, and not a genuine long term solution)
Searches for URL in message which include domains which are blacklisted to increase score
Searches for phone numbers using a CPU intensive regex pattern matching to deal with many many kinds of phone number obfuscation.
Use of various spam-blacklisting services by SpamAssassin for checking mail/checksum/header data. to increase scores
Inclusion of language control rules to increase scoring on languages I do not want to see
Inclusion of locales controls to increase scoring on locales I do not want to see
Separate userDB based Basian filtering (100MB db per user) with automagical bayesian spam marking for items older than 14 days still in user's graymail boxes, after which point, the 14 day old messages from greymail get moved to trash where a 21 day old check purges messages older than 21 days. [This also includes auto-ham of messages that are older than 14 days which have been read which are still i the inbox]

We have tried using various IP based blocking systems, but since we have users from all over the world, this does not work well.

The earlier you can block a spam source, the less in resources you need to use for analysis. SpamAssassin is a HEAVY resource user (both memory and CPU. With all of our rules, we push about 75MB per spamc instance with maxlimits of children imposed, even though the 75MB of RAM "used" is not a truthful evaluation due to .so and shared memory/libs working magic in our favor.)

If you go with SpamAssassin in a large scale, seriously consider use of SQL stored SA prefs, so you can load balance multiple spamassassin servers which each consult a single DB.

[Edit: added content above in [ ] ]

[astcell]

I use Antigen for Exchange by Sybari to go after viruses, and they offer a Spam manager as well. I do not want too many different programs probing the mail interface!

[[Syntax]]

Recently I started receiving spam that is nothing more than an image with all the text and crap in it.. make it alot harder to filter.

[converge]

not if you filter out emails with:
) only an image
) images that exceed <insert>

[audit]

We use SurfControl at work for our web traffic and GFI for our SPAM. Both work great for us and many of ex employee's can vouch for that.

[lil_freak]

Anti-spam products can sometimes be the worst solution, depending on what type of mail your employees need to receive.

My place of work thought by using InboxShield our spam problems would be over. InboxShield sucked and we only used it for about a month or so, then we went with SurfControl E-mail Filter and Anti-Spam Management. However, it caused more problems than it helped. While the spam mail did stop coming through, so did some of the email that was needed in order to perform our job functions.

This caused a huge rippled in my organization.
After about two months of problems we ended up using a program designed for us specifically, by a local software firm. We still get some spam now and then, but all of the mail we need to receive comes in just fine.

So while you consider using a program to stop the spam-mail, think about things like what kind of mail does your company get might be marked as spam? If the program you’re looking at will provide you with an interface that you can customize to suit your needs? Would it be better to have someone come in and design a program to fit your needs?

[audit]

All the mail marked SPAM comes to my mailbox and then I am the judge on what needs to be sent on and what goes to the trash. GFI has been a great help on what's marked and saved me many hrs on going through mail considering my mailbox has over 8k e-mails when I get to the office in the morning.

[geekgurl]

Exchange 2003?!

So it's been suggested by someone at work to upgrade to Exchange 2003 because it's got built in spam filters. Somehow that just doesn't sound like a good plan to me.
I have a Barracuda appliance eval on it's way to see if we want to go that route. Spamassasin seems to be the leading contender so far.

[astcell]

I have Exchange 2003. It is better than 5.5 but if you count on it for Spam Filtering you will be wholly unimpressed.

[oz0ne]

Spambayes
spambayes.sourceforge.net


FREE
99.9% accurate
No static filter

Learn it, love it

Can run on many platforms, nice option that integrates with Outlook.
I know, I know, we're a M$ shop so we don't have much choice....