REAL-TIME-BLACKHOLE Lists

ACTIVE SPAM FILTERS

SPAMMERS cheat, steal and lie. They use information provided for one purpose (such as buying something) to bombard you with undesired advertising. They find machines that are not fully guarded, and steal their processing and bandwidth to send out their messages. They pretend to be other people, or to have bought a mailbox on honestly run systems, causing distress to the net-users whose identity they have stolen.

Finding SPAM is not easy, but some general approaches work. There is a small risk of false positives, but that is better than the prospect of fifty unsolicited messages in one's mailbox each morning.

Most SPAM comes in from places that didn't ought to be sending mail directly. We buy a service from a company that tracks systems that are being used to send or relay SPAM, or which have been marked by the network owner as not legitimate mail sources. We use these realtime-blackhole-lists to block messages that have not been authenticated.

That means our customers can still connect, and using their password send mail, even from otherwise blocked sites, but no other messages will be accepted from such sites.

OA5 uses an anti-SPAM tool called ASSP which uses a 'Bayesean filter' to see if the message contains spam language or normal language. It has fairly good discrimination, and also blocks executable attachments, so the only way you can get a virus is by opening a .zip file and running what is inside.

See elsewhere for how to use this Creating rules to use the X-Assp-Spam-Prob: heading

The filter is based on analysing a lot of mail, both spam and not spam to work out which vocabulary indicates either type of message. If you get spam which the filter has not caught, we have feedback addresses spam@ns1.knots.net and realham@ns1.knots.net, or if you use IMAP you can file spam that gets through in <<other users>>/spam, and anything that comes through marked as SPAM which is not in <<other users>>/notspam, and this will help our filters adjust to make a better distinction.

These accept emails to adjust the filters in the obvious way --- things that come through marked SPAM which are not should go to not-spam, things that come through unmarked which are spam need to go to the spam address.

It only works properly if you can bounce or resend the mail to the appropriate address, in particular forwarding, either by inclusion, or as attachment is NOT helpful.

If you have a local webmail account you may subscribe to 2 additional folders 'user.spam' and 'user.not-spam' which are where some messages are collected before going into the feedback. You can then simply refile mail into those mail folders, rather than bouncing