What can we expect to see roberto? Or what are you working on?

I think the next thing I would like to see is integration with firewalls. Alot of spam could be reduced if the firewalls were able to simple shun the traffic.

Roberto,

How about ... RHSBL support.

Regards,

Comment on the auto-blacklisting:

While I, personally, would like the feature, in the ISP enviroment, this could cause problems.  Remember, one users spam is another users entertainment.  So if user "A" blacklists email from say ... "hotnurses.com", user "B" may get ticked off.  However, the idea may be able to be fined tuned.

AOL has implemented this in a way that causes problems.  We have a customer that has a fully complient "Double Opt In" mailing list and when an aol user decides he no longer wants the mailings, instead of un-subscribing, he clicks on a button that tells aol that it is spam.  If aol gets 12 in an hour (not a large number) ALL email from that IP gets blocked for either 24 or 48 hours.   All of a sudden, 3,000 aol users complain that they are NOT getting their mailing list.

So, this feature has to be well thought out.

Regards,

Edited by Desperado

RHSBL and SURBL

How about creating columns in the quarantine data base for "from domain", "from IP", and etc. By providing this info in seperate columns it would be much easier to work with the database and determine better rules for filtering.

Thanx - Cire

All,

Thanks for the comments/suggestions. Here's our own 2 cents:

The "Honeypot" idea was great, thanks Alan. We just uploaded in the registered user are build 2.5.1.250, which does have this feature. In this new version there is an additional blacklist: "Honeypot". It contains a list of email addresses to be used as honeypots. Any emails sent to an address in this list will cause the sender's IP to be permanently blocked. The list of auto-blocked IPs is saved in the file "HoneypotBlockedIPs.txt".

We will be hopefully implementing RHSBL and SURBL next.

As far as teaching the statistical filter about the "false negatives", this would require storing "good" messages along with spam in the database. Additional interfaces must be developed to allow end users match the spam they receive to the "good" email that was stored in the database. This feature will require major changes/development, and has so far been set aside.

We're very hesitant in having SpamFilter control firewalls, as that can potentially cause disastrous situation in case there are "hiccups", so that will be set aside as well - too much liability there....

Hey thanks for putting that into a build so quick Roberto.

Another minor request: a way to add comments and to disable line items in the text lists.  Maybe an apostrophy as the first line item to ignore the rest of the line as comments?

I guess I would like them to work more like script that can be well annotated with comments with the ability to temporarily disable certain portions.

LogSat wrote: All, Thanks for the comments/suggestions. Here's our own 2 cents: The "Honeypot" idea was great, thanks Alan. We just uploaded in the registered user are build 2.5.1.250, which does have this feature. In this new version there is an additional blacklist: "Honeypot". It contains a list of email addresses to be used as honeypots. Any emails sent to an address in this list will cause the sender's IP to be permanently blocked. The list of auto-blocked IPs is saved in the file "HoneypotBlockedIPs.txt". We will be hopefully implementing RHSBL and SURBL next.

Ok just thought I would ask again.
As far as the honeypot, I have entered a number of old defunct email addresses that are apparantly on a lot of spammer lists and have had it running for the weekend, but have not logged a single entry in the IP list yet.  Could it be because the emails were snagged or blocked by one of the other filters?

kspare wrote: The auto whitelist is on a per email address basis, why couldn't the blacklist be as well?

I think this is a great idea. Especially for those of us who are hosting multiple domains. We use the the autowhitelist extensivley and allow our customer to whitelist their own customers via a form as well as the quarantine db. Once that domain is no longer with us, we just remove any references to that domain in the autowhitelist text file.

If you had an option that worked the same for blacklisting, I think your sales to ISP's and web hosting companies would increase quite a bit.

Any engineering reasons why this could not be done?

Thanks for listening.

   I used to gather my own IP's to block with a honeypot mechanism I devised but eventually had to scrap it because zombie PC's on networks like Comcast and SBC were being used to send spam which would of course cause my honeypot system to block the IP's of valid mail servers.

 

 

configurable logging options in the ini ?
great product !

the sawmill template was great, for my brain dead management, a webtrends template would also be great.

-eric-
(user/admin of since version 1.0)

version SpamFilter ISP v2.5.1.450 logs a little too much ...

_Eric wrote: configurable logging options in the ini ? great product ! the sawmill template was great, for my brain dead management, a webtrends template would also be great. -eric- (user/admin of since version 1.0) version SpamFilter ISP v2.5.1.450 logs a little too much ...

Eric,

I feel the you can never log "too much". I have a script to "split" the logs on servers where they get too large.

Dan

Edited by Desperado

//and logfiles are now on a spare u360 scsi drive, in order to keep performance in a normal level. //

this drive is mounted as \logfiles in
%drive%\%logsatrootdir%

-eric-

Although there may be some quirks depsnding on how it is used, it would really be a useful feature for others who want to have the redundancy.  Others who do not want to use could simple not do so.  What are the chances you can put this into a build?

LogSat wrote: Alan, If I understood correctly, are your secondary MX servers forwarding emails to SpamFilter? If so, you may want to reconsiders, as since many of SpamFilter's rules work on the spammer's IP. IF SpamFilter sees your secondary's IP instead of the real sender, many tests will be unreliable and SpamFilter's actions will be inaccurate. I would see your request for an exception, but there may be other quirks with that configuration.