Built For Designers & Developers

Spam Assassin Overview

If you have ever had an email account (who doesn’t?), you know how annoying spam can be and how it is an unavoidable evil of using email. Even though there is no sign of spamming ever stopping world-wide, things can be done to prevent a majority of spam from making it to your inbox.

In this post, we’ll explain a few things we do on our end to help keep as much spam from reaching your inbox, giving you more time to read actual email.

Spam protection on our servers begins with SpamAssassin. SpamAssassin scans all incoming messages for common spam criteria and then assigns a “score” to that each message. On an account level, SpamAssassin can be configured with how you would like messages of a certain score to be handled. For example, SpamAssassin by default will look for messages with a score lower than “5” meaning that any message with a score below “5” will be marked as a spam message. You also have the ability to configure how these messages marked as spam are handled, be it discarded, marked, or routed to a spam folder that you can look through at a later time and make sure legitimate email is not being blocked.

SpamAssassin also allows you, with a bit of simple coding, to “train” it so that it “learns” what you mark as spam to help improve it’s scoring and blocking capability.

But, even with those features, SpamAssassin is not perfect and spammers are always finding ways to word or format their messages so that they beat the checks and make it to your inbox. Due to this, we’ve added some new features/plugins to our SpamAssassin installs to help make it even better at blocking incoming spam before it makes it to your inbox.

The first of these is “DCC” which stands for Distributed Checksum Clearinghouse. A complicated name, for something very simple! The basic function behind DCC is that most spam mails are sent to many people and the same message appearing many times in those emails, is bulk email. DCC identifies bulk email by taking a checksum (a unique identifier) and sending that to a Clearinghouse (server). The server then responds with the number of times it has received that checksum. An individual email will create a score of 1 each time it is processed and then bulk mail can be identified because the response number is high. We also run our own DCC servers to ensure lookups can be performed as quickly as possible.

The next of these additions is Razor. Razor is also a checksum based spam detection network that creates a distributed and constantly updating catalogue of spam through user contribution. User input is validated through reputation assignments based on consensus. So, essentially, if a large amount of users are marking a specific type of message as spam in their mail clients, this is picked up by Razor and added to the spam database. With this system being based on user input, it makes Razor extremely powerful in tracking spam messages that have mutating content that might not be as easily tracked by other systems looking for bulk mailings containing the exact same content.

The final addition is CRM114 which is a program that uses a statistical approach to score messages as being potential spam. The benefit of CRM114 is that it achieves a higher rate of spam recognition through creating hits based upon phrases up to five words in length whereas other spam scoring methods check the frequency that single words appear in messages. This means CRM114 tries to use logic to filter out spam, instead of just counting how many times a word shows up.

The combination of these 3 additional plugins installed within SpamAssassin, make it an extremely powerful tool in tracking and recognizing which messages being sent to your inbox are spam and preventing them from making it to your inbox. Of course, as these tools are added and SpamAssassin’s spam blocking ability increases, you may find that previous configuration settings (such as lowering the spam score to “3” or lower in your SpamAssassin configuration panel) you might be using are now blocking legitimate emails. If you find that is the case, the best option would be to set SpamAssassin back to the default settings of marking messages with a score of “5” or less as spam. This should then help get those legitimate emails to your inbox instead of having them falsely marked as spam.