We operate a small Windows shop with Exchange. Spam is a constant problem; we get thousands of spam messages a day and manage to remove most of the spam by using a filter on our incoming SMTP port. Still, some trash gets through. 1% of 10K spam messages per day is still really a pain.
We currently use Xwall as a spam filter. It has two really good features.
- Graylisting (simply ignoring a first email from sites previously unseen; real mailers at such sites resend after a bit so such mail gets through, but spammers almost never resend). This catches 90% or more.
- The ability to eliminate (spam) email by checking for certain string patterns using some simple wild string matches (text with asterisks for wildcards).
However, it isn't consistent in allowing pattern checks on any email field (notably we can't apply any filters to "From:" which the spammers seem to fill with lots of useful "I'm spam" indicators e.g., "From: Discounted Cars ([email protected])". Nor does it allow powerful pattern matching (e.g., decent regexps). Absence of regexps means false positives and false negatives. We've complained to the Xwall guys about this for years but no response.
Is there a spam filter application that has:
- Graylisting
- Whitelisting with regexps on email addresses
- Real regular expression filtering on all email fields, by field. Since regexp filters are invented to stop a particular wave of spam ("What has Martha Stewart done to her face?"), a really nice property would be termination date (default 90 days?) to let such filters age out with the capability to easily re-enable if the spam wave continues.
- The ability to filter out email based on misspelled words (How many ways can you mis-spell "cialas" using funny characters for i and l?)
- Recording of all incoming email in a log, with filtering reason (including "none")
- Ability to designate a filtered-out email entry as "OK" to resubmit, to handle the occasional false positive
Other features such as Bayesian learning are nice to haves but not necessary.
Since such a filter accepts SMTP messages on a publicly visible SMTP port, and forwards (filtered) messages to an internal SMTP port that we provide for Exchange, it doesn't matter where it runs to us. In particular, it is acceptable for the filter to run on either Windows or Linux.
Our Exchange server is rather old (2005) and we're getting ready to upgrade. I'd be delighted to hear all this stuff is built into modern versions of Exchange. Pessimism abounds.