Spam filters with good regular expression support on all email fields?

Question

We operate a small Windows shop with Exchange. Spam is a constant problem; we get thousands of spam messages a day and manage to remove most of the spam by using a filter on our incoming SMTP port. Still, some trash gets through. 1% of 10K spam messages per day is still really a pain.

We currently use Xwall as a spam filter. It has two really good features.

1. Graylisting (simply ignoring a first email from sites previously unseen; real mailers at such sites resend after a bit so such mail gets through, but spammers almost never resend). This catches 90% or more.
2. The ability to eliminate (spam) email by checking for certain string patterns using some simple wild string matches (text with asterisks for wildcards).

However, it isn't consistent in allowing pattern checks on any email field (notably we can't apply any filters to "From:" which the spammers seem to fill with lots of useful "I'm spam" indicators e.g., "From: Discounted Cars ([email protected])". Nor does it allow powerful pattern matching (e.g., decent regexps). Absence of regexps means false positives and false negatives. We've complained to the Xwall guys about this for years but no response.

Is there a spam filter application that has:

• Graylisting
• Whitelisting with regexps on email addresses
• Real regular expression filtering on all email fields, by field. Since regexp filters are invented to stop a particular wave of spam ("What has Martha Stewart done to her face?"), a really nice property would be termination date (default 90 days?) to let such filters age out with the capability to easily re-enable if the spam wave continues.
• The ability to filter out email based on misspelled words (How many ways can you mis-spell "cialas" using funny characters for i and l?)
• Recording of all incoming email in a log, with filtering reason (including "none")
• Ability to designate a filtered-out email entry as "OK" to resubmit, to handle the occasional false positive

Other features such as Bayesian learning are nice to haves but not necessary.

Since such a filter accepts SMTP messages on a publicly visible SMTP port, and forwards (filtered) messages to an internal SMTP port that we provide for Exchange, it doesn't matter where it runs to us. In particular, it is acceptable for the filter to run on either Windows or Linux.

Our Exchange server is rather old (2005) and we're getting ready to upgrade. I'd be delighted to hear all this stuff is built into modern versions of Exchange. Pessimism abounds.

Answer 1

Bayesian filtering is so millenium. ;) Honestly though, over the last five years the email industry has changed so much that it's nothing like it once was. Bayesian filters used to be the norm for filtering, and now they are very lightly used to only tag the most obvious offenders that are very clearly unsolicited messages.

IP Reputation is where you need to look, as most unsolicited messages come from bot networks filled with IP's that only ever send out a couple hundred spam messages and have no built up reputation so it's an easy spam flag.

Barracuda offers such a service, along with some others.

Honestly though - for what it's worth - move your email to a dedicated email provider. Unless it is critical for your email services to stay in house, it's not worth trying to keep it in house anymore. It's getting to the point where companies need to hire a team of email experts just to keep something like that in house as the maintenance required is getting further and further out of control.

Google would be my top choice, or Amazon. Google's antispam is quite frankly, amazing and false positives are relatively rare and the worst I usually miss out on is a newsletter that I legitimately signed up for.

Answer 2

GFI MailEssentials supports Outlook with

user-based filtering rules enable flexible and granular filtering of any part of the email message – including message headers, subject, body, attachment name and attachment content -- using different types of pattern-matching methods, including regular expressions.

• Graylisting. http://kb.gfi.com/articles/SkyNet_Article/What-is-Greylisting-for-GFI-MAX-MailProtection-and-GFI-MailEssentials-Online?retURL=%2Fapex%2FSupportHome&popup=true http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials/specifications/hassle-free-spam-and-malware-protection
• Whitelisting with regexps on email addresses.
  

  http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials/specifications/email-content-policy-enforcement

• Real regular expression filtering on all email fields, by field.

  The keyword-checking functionality in GFI MailEssentials can be used to scan emails for keywords and the attachment-checking functionality scans emails for attachments. http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials/specifications/email-content-policy-enforcement

• The ability to filter out email based on misspelled words

  Advanced user-based filtering rules enable flexible and granular filtering of any part of the email message – including message headers, subject, body, attachment name and attachment content -- using different types of pattern-matching methods, including regular expressions. http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials/specifications/email-content-policy-enforcement

• Recording of all incoming email in a log, with filtering reason (including "none")

  • Web-based console with integrated reporting http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials/specifications/web-based-console-with-integrated-reporting

• Ability to designate a filtered-out email entry as "OK" to resubmit, to handle the occasional false positive

  With the GFI MailEssentials Spamtag addon for Outlook, users can mark individual emails as ‘spam’ or ‘not spam’ direct from Outlook. http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials/specifications/hassle-free-spam-and-malware-protection

Also

The POP2Exchange feature gives companies using external POP3 email accounts a practical way to receive emails without the need for a dedicated email server. http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials/specifications

Multiple anti-spam filters http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials/specifications/an-arsenal-of-anti-spam-filters

IP Blocklist Anti-spam Plugin - Lets email admins update GFI MailEssentials with the IP Addresses of ‘spammy’, compromised or mailicious smtp servers so that emails originating from these servers are deleted or quarantined.

Answer 3

MailRoute Inc. is an email security provider that ‘washes’ email for viruses and spam. The service works by taking over the role as a middleman in the DNS MX record between the open Internet and the email server. The service also protects against email server outages by temporarily hosting incoming emails until the email server is ready to receive messages again.

MailRoute's features are listed at https://www.mailroute.net/

• GreyListing to block spam 'bots and zombies
• Blacklists of known spammers.
• Spam fingerprint databases.
• Lexical analysis to identify common spam words or phrases.
• Bayesian filtering.
• Distributed traffic pattern analysis identifies new spam.
• White and Blacklists let you adjust scores, depending on the sender.
• Quarantine: spam is stored in the MailRoute SpamStore® for seven days, and is accessible via a web-based interface.
• Subject line rewriting: prepending of a word or phrase and the SpamScore® into the message's Subject line.
• Custom header lines are added to each message so you can select your own criteria for filtering.
• Customizable on a per-user or per-domain basis. Each user may have their own individual settings for sensitivity and processing.
• Domain-wide or individual white and blacklists let you block or allow specific addresses.
• Compatible with all email systems - regardless of platform or underlying operating system.
• Implementation takes only minutes and is risk-free.
• 99.999% uptime guarantee.

See detailed user review at http://community.spiceworks.com/topic/341240-so-far-so-good-on-mailroute-spam-filter-free-trial