Email spam blocking techniques fall into one of two broad areas. The first area, common in small to midsize sites, is to add spam blocking technology into the Mail Transfer Agent (MTA) - Exchange, Sendmail, Postfix and Communigate are all examples of MTAs. The second technique is more commonly used by large sites and sites with dedicated mail administrators, and that is to put a mail-blocking appliance between the MTA and the Internet. Both techniques have in common some sort of automatic update mechanism so that the MTA or appliance is kept up-to-date against the latest spam sites, patterns and attacks. One of the more popular anti-spam software titles for these purposes is GFI MailEssentials. GFI MailEssentials can be installed directly on the mail server or be installed on a dedicated machine to create a low-cost appliance solution.
Blocking in the MTA has the advantage that no additional hardware is required. Also, the learning curve can be quite short, as the better packages just plug right into the mail server and need relatively little configuration. On the other hand, for the do-it-yourselfers running UNIX and sendmail, the learning curve can be just as long as you like.
Appliances are more commonly used by large and very large sites because they can handle extremely high volumes (millions of messages per day) and can be configured in redundant configurations so that no single failure will disable spam filtering. The appliances are basically high-quality PCs with custom mail software and special configuration front-ends. They are complex devices and generally require expert mail administrators to get the most out of them, although the vendors will configure and maintain them, for a fee. The very largest sites (AOL, Yahoo, Google and MSN Hotmail) essentially build their own custom appliances. Appliances will work in front of any MTA.
sendmail, exim, smail, qmail, postfix, PMDF MMDF, PP, Macintosh, Microsoft Exchange, Microsoft Windows, any (or many) MTA(s).- [sendmail]: Sendmail, the most commonly found UNIX-based mailer, has information on spam blocking here.
- [sendmail]: sendmail MTAs which accept SMTP email from currently active POP clients should read details of POP before SMTP to avoid spurious relaying, or an alternative.
- [sendmail]: xmission.com have their own sendmail.cf rules to cause mail from named site to be returned to sender.
- [sendmail 8.8.2 and 8.8.3]: Wolfgang Rupprecht has supplied a routine using check_compat that can be used to block spam mail or prevent all third-party relaying.
- [sendmail]: Pete Ashdown has contributed a procedure for dropping spam mail. His procedure accepts the SMTP mail and then drops it during the delivery phase.
- [sendmail 8.8.2 and later]: Claus Aßmann has put together a very detailed write-up of using the check_* routines.
- [sendmail + compatibles]: Christian Alice Scarborough's perl5 package splam-2.0 [ Used to be called `ignore-spam' ]
- [sendmail + compatibles]: Ian Leicht's PERL5 package the NAGS Spam Filter can reject spam mail automatically, sending a rejection letter with details of how to get past the block.
- [sendmail]: another example of how to block spam
- [sendmail]: Dansie Spam Net is a commercial score-based filtering system for sendmail with perl. It is web-manageable and so suitable for hosted e-mail environments.
- [Sendmail]: ScanMail is a commercial general mail filter package, useful for spam and virii.
- [Sendmail]: E-mail Processing Agent is a mail server software add-in that controls incoming and outgoing, Internet and intranet e-mail to eliminate 100% of unwanted e-mails (including "spam").
- [sendmail/rbl]: MAPS is now Trend Micro Message Security.
- [Sendmail]: Milter-greylist is a sendmail milter that implements "greylisting" - refusing mail from never-before-seen hosts with a temporary failure. Legitimate mailers requeue and retry the message, while much spamware does not.
- [Sendmail]: The greylisting paper discusses greylisting in detail and provides a perl-based sample implementation of a sendmail milter.
- [exim/rbl]: If you can change your mailer from (e.g.) sendmail but need to keep the mailbox format (etc) unchanged, you may care to look at exim(overview) which is a ``drop in replacement'' for sendmail, a `next generation' smail, which can use the MAPS RBL to block spam domains from version 1.735.
- [smail]: Since 3.2.0.95, smail can restrict which addresses can relay email, e.g. `
smtp_remote_allow = 194.64.4.*:194.163.56.*' - [qmail/rbl]: If you can completely change the way email is processed, you may care to look at qmail. There is info on how to use rbl.
- [qmail]: Mikio Okawa's dynamail is a package for qmail that allows ordinary users to create temporary, access limited e-mail addresses.
- [qmail]: SPAMbaffle is spam filtering software which can be set up either by indiviaul users on a Qmail system, or by the system administrator. It filters based on email headers, the message body, and the MIME types or filenames of attachments, and can either drop or bounce messages that it catches, with customized bounce messages.
- [postfix]: Postfix, by Wietse Venema, installs with relaying and volume controls set to sane values by default; is under very active development to make controls for relaying easy to set correctly if the default values won't do, and difficult to set in such a way as to allow unauthorized relaying; and is supported by an extremely active users' mailing list (including active participation by Venema) that's extremely anti-spam. [PMDF]: E.vanRhee@co.hvu.nl says that to block mail from hotmail.com, you need to edit the mapping file PMDF_TABLE:MAPPINGS (for VMS) or /pmdf/table/mapping (for Solaris and Digital Unix), e.g.
SEND_ACCESS *|*@hotmail.com|*|* $N *|*|*|*@hotmail.com $N
No comments:
Post a Comment