Technology Advisor Blog

Here's a question we hear a lot:  "Why doesn't my spam filter block ALL my spam?"  We typically implement Postini spam filtering for our clients (sometimes Barracuda), and when we examine the monthly reports, overall, about 80% of incoming mail is either blocked or quarantined as spam.  This is a HUGE amount of mail, and consistent with industry reports which typically track even higher in the 90% range.  The filters, though not perfect, keep a LOT of clutter out of your inbox and off your smart phone.

Even with sharp attention to setting proper specs on the filters, though, some spam will still get through. A big portion of spam is blatant, and in Postini is put in a "black hole".  The rest of the questionable mail is put in a "quarantine". The interesting thing to note is that what is obvious to any human (hey, this is spam!), may not be obvious to a computer, so a few will get through.

When we analyze a message, we look at the "Internet Header". This is the technical detail embedded in the email (not just the "to:", "from:", and "subject" line), that shows how the mail was processed and the path it took through the Internet.  To see the header of an email in Outlook 2010, click on the message and hit the "File" tab and "Properties" button.  At the bottom of the pop up, you'll see "Internet Header", filled with a bunch of technical information.  Here you can see who the message is really from (is it spoofed?), and whether or not it went to the spam filtering servers (sometimes if there are cached or extra "mx" records, mail can bypass the filters).  Using the Internet Header, we can also analyze the scoring for the filters.  In some cases, we'll see something barely pass through the spam filters with carefully chosen words, but will later be blocked when the filters catch up to the volume of the same message.    It's a bit of a cat and mouse game.

Many users are frustrated when the opposite happens, that is, a message is falsely flagged as spam.  In some cases, legitimate bulk mail (such as sales promotions from a favorite store) are quarantined because they are in fact bulk commercial mail (safe-list the ones you want), but in other cases, an individual message can get blocked.  Unfortunately, the "bad guys" who are producing huge volumes of junk create an inconvenience for the "good guys". 

For a short tutorial (4.5 minutes) on how to use the Postini message center, please check out our YouTube Video at: http://www.youtube.com/watch?v=vxPu_BxAxMo&feature=plcp