SpamFoo thus far
Problem reported by echoDreamz - 6/28/2026 at 2:22 PM
Locked
Submitted
It's been about 15 hours so far, I’ve seen legitimate emails from American Express (credit limit increase notification), Amazon (purchases and subscription notifications), Duolingo, Temu order updates, Booking.com offers, several known clothing Company marketing emails, various legit emails from WorkDay, and Realtor listing change alerts incorrectly flagged as spam by SpamFoo.

It has however correctly identified several phishing attempts and is effectively catching a large volume of spam, particularly from low-quality TLDs such as .space and similar domains.

Resource usage shows the spamfoo-client.exe process consuming approximately 270MB of RAM and averaging 1–3% CPU usage, with periodic spikes up to 47%. The initial startup exhibited a higher CPU spike, I assume data loading and initialization.

Network activity is minimal and primarily consists of DNS queries to internal DNS servers, along with connections to 192.68.130.30 (rdap-1.verisigndns.com). This traffic appears to be related to domain/RDAP or WHOIS-style lookups.

109 Replies

Reply to Thread
Matt Petty Replied
Employee Post
Thanks for the update, insanely valueable information thank you. 
Matt Petty
Senior Software Developer
SmarterTools Inc.
echoDreamz Replied
Yeah, so far, it's working, just a bit concerning about the false positives. Still seeing a lot from legit businesses, mainly newsletter type emails, but also transactional emails, banking emails etc.
Tim Uzzanti Replied
Employee Post
We would love to see some examples.  Also, any moving of those messages to and from junk and or classifications will make immediate improvements.  Keep in mind, even legit emails have some spam score but it’s the weight you associate to them that matters and truly decides what is spam or not.
Tim Uzzanti
CEO
SmarterTools Inc.
Gabriele Maoret - SERSIS Replied
I see the same problem with "Classification"...
Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Matt Petty Replied
Employee Post
If you still wish to use classification without back-scanning there is also a number near where Email classification is enabled for controlling how many messages into the inbox we'll go for classifications right now this is set to a very high value, I'd set this to either 0 or a low value like 100 for now to get around the "months" issue.

We'll be taking in all this feedback and I'm sure there will be more posts throughout the day. 

For now, there is a lot of information and data to look through, cheers all, got a lot of work to do.

P.S. set the spam weight accordingly if you aren't confident but still wanna see it "perform" you can try setting the weight to 0. I'll say based on our internal testing and anecdotes spam gets pretty hectic Monday morning.
Matt Petty
Senior Software Developer
SmarterTools Inc.
terry Replied
This has been working fairly well f9r us so far, running on linux and not a lot of users.

One thing I would really like to see is more info in the dashboard. Message subject would be nice to see, and when clicking on the message for detail show some of the email text. This would allow us to verify spam a lot quicker than having to login and browse to spam folder to verify spam.

A little more info in the header entries would also be nice.

Terry

David Replied
Been running it since morning... after figuring out how to start it. About 100 messages, didn't mark a single one as SPAM. There were a few that look like mass sales emails, should have marked them. But maybe it can only deal with English text ? I don't really know how it works. Will leave it on for a week and see.
Matt Petty Replied
Employee Post
SpamFoo does have the technical capability with it's underlying "embedding" model, this is how it turns an email into something the models can train against.

We are addressing an issue right now with how we're loading our models when running on a non en-US server. Stay tuned on this, leave it off for now if it's causing you issues but the way it's designed shouldn't break delivery if it has issues (same with all the other antispam providers).
Matt Petty
Senior Software Developer
SmarterTools Inc.
Bruce Replied
Thank you for your response, Matt. I tried setting the Email Classification to 0, but it only classifies mailboxes that contain 0 messages. I don’t see any other options for controlling how many messages should be included in the inbox for classification.

Matt Petty Replied
Employee Post
Thanks for that note Bruce. 
I'm gonna write that down to discuss that functionality, I feel like it should do X of all inboxes but we'll dial in that behavior.
For now this would mean that all NEW emails would get classified for everyone still, but you can disable this option to hide the option from user's if you're worried about them wondering where there stuff is.
Matt Petty
Senior Software Developer
SmarterTools Inc.
Matt Petty Replied
Employee Post
SpamFoo DOES have the technical capability to scan multi-lingual emails. SpamFoo uses a multi-lingual embedding model, this is effectively how it turns an email into a bunch of numbers that can be trained on that models understand.

There is an issue with the client not running correctly (locale issues) when running in some environments. Stay tuned, should have something about this.
Matt Petty
Senior Software Developer
SmarterTools Inc.
Zach Sylvester Replied
Employee Post
Hey @Reto

If you move the emails out of junk to your inbox it will send SpamFoo a correction so they can improve their models. It will also immediately improve your local system as Spamfoo as an local correction system meaning corrections take immediate effect. 

Kind Regards,

Zach Sylvester

Software Developer
SmarterTools Inc.
Zach Sylvester Replied
Employee Post
Hey @Reto

Thank you for getting back to me. Do you think you could open a ticket and send a zip file with some of your false positives then we can share some of the data with spamfoo? If you could share emails that do not contain PII or just modify the emls so they dont contain PII that would be great. We will also review them and make sure they dont contain any PII.

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Nick Jansen Replied
@Zach
1. Does that model improvement method work both directions (Junk to Inbox, and Inbox to Junk)?
2. What about moving an email from Junk directly to another folder (not the Inbox), like ones that users create to sort their incoming email?
3. Does this work for any client (including Outlook via MAPI), or just Webmail?
Tim Uzzanti Replied
Employee Post
Nick,

1) Yes
2) No, but will be changing in the near future.
3) Yes, any client. 

Tim Uzzanti
CEO
SmarterTools Inc.
David Replied
Hi Tim,
Can you confirm this to work for IMAP as well (if IMAP client moves something from Inbox to Junk or the other way around) ?

Thanks,
David
Gabriele Maoret - SERSIS Replied
I have updated and (after the new SpamFoo release) it seems to work quite well.

The only thing is that SpamFoo is not so good with Italian emails (a lot of false positeves), so I set the score to 5 for now...
Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Tim Uzzanti Replied
Employee Post
Gabriele,

I'm glad to see you reduced the score and are giving it a little time.  SpamFoo learns quickly, and if you and some of your users do some training and reclassifications, the results will be amazing.  

As we move past this rollout, we will be going into more details about best practices from our new Adaptive Intrusion Detection, Greylisting, DKIM, and some internal spam checks in conjunction with SpamFoo.   

I've got mail accounts on a variety of servers and services, and the amount of SPAM is out of control.  We’re really looking forward to helping our customers and your customers have a very different experience.  
Tim Uzzanti
CEO
SmarterTools Inc.
terry Replied
We also had to reduce the weight to 5 and enable our old spam checks. the number of false positives are too high. I do like the idea of this product, but it still needs some work.

As per my previous post. the dashboard needs to have more info and control over spam. Being able to move spam to the inbox from the dashboard would be a huge bennefit.

have also noticed a few emails being flagged as spam when we have added the domain to the Rules list as Not Spam.

Terry



Tim Uzzanti Replied
Employee Post
Terry,

The SpamFoo dashboard has no connection to SmarterMail. The dashboard is showing you all the work that SpamFoo has done and allows you to control the settings for rules, phishing, etc., that will be processed on future emails that come to your inbox. 
Tim Uzzanti
CEO
SmarterTools Inc.
terry Replied
Okay, but the dashboard shows from and to address's and Ip's, so it has access to info. Would still like to see the Subject of the email. and some message body when clicking on detail. It is time consuming checking Junk Folders to see if they are legit spam or false positives.

Terry

Tim Uzzanti Replied
Employee Post
Terry,

We will pass the reqeust onto SpamFoo. Since the messages were processed on that server, I’m not sure why they couldn't show it. And, they have a Gateway service that they are going to be releasing as well, and my guess is, they would probably need that information there as well.  

Thanks,
Tim Uzzanti
CEO
SmarterTools Inc.
Linda Pagillo Replied
Hi @SmarterTools team!

Just some feedback. I'm running the latest version of SM on a test server that I set up to be a spamtrap. I'm have a lot of spam going to that server etc... I'm noticing that SpamFoo is working pretty well, but it is marking a lot of messages as not spam even though Message Sniffer and Declude are scoring them high enough to be classified as spam (over weight 30). In other words, possible false negatives on SpamFoo's part. Would you like me to open a ticket with you guys and submit some headers so you can have a look? Or would you prefer I do something else to get some samples to you? Thanks! 
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
Tim Uzzanti Replied
Employee Post
Reto,

That is why you should start with lower spam weights with ANY new Antispam solution you use. Some old Antispam products with just rules don’t need as much exposure to your mail, but they also don't perform very well.  Any of the new Antispam products that are AI-based drastically change over time.  

Thanks,
Tim Uzzanti
CEO
SmarterTools Inc.
Linda Pagillo Replied
Thanks @Reto 

I'm having more of an issue with false negatives than I am with false positives right now I think. I need to dig deeper into it to see if I'm getting any/many false-positives.
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
Tim Uzzanti Replied
Employee Post
Reto,

How we implemented SpamFoo.

Added SpamFoo to the existing mix of Antispam configurations we already had. We only gave SpamFoo a weight of 5 or so.

For messages that were on the bubble of being SPAM previously, the extra weight of SpamFoo would push them into Junk. We saw very few false positives.

Things that didn't get pushed into Junk, we just moved to Junk via (clients or Webmail), which trained SpamFoo.

After a week or two, we started increasing SpamFoo weights and decreasing other weights until we eliminated Cyren and Message Sniffer and then re-optimized the weights with the functionality we provide in SmarterMail.  

The result, we didn't miss anything. We trained SpamFoo on our mail and now we have little to no SPAM.

Hope this helps. 
Tim Uzzanti
CEO
SmarterTools Inc.
David Replied
I have to agree with others about false positives. I've had important business mails marked as spam by SpamFoo, this is not good.

Since my rule to move them to Junk folder when score is above 30 they didn't get moved to Junk, which is both good and bad. It's good because we didn't miss these emails. Then it's bad because: how do we train the algorithm if the message doesn't get moved to Junk first, so we can move it back to Inbox, in order to train the thing. I'd actually need to configure the system to move every message that SpamFoo flags as spam to Junk first (which I obviously don't want to do, not sure anyone would want to) but that's what is needed to make training possible. And training is apparently something one can't do without.

So I'll ask a blunt question: what's the plan about this ?
Knowing this system sends various metrics back to you... well, please enlighten me before I slip on the wrong track and start thinking you're using the beta to train the system in the field before it hits production :)
Tim Uzzanti Replied
Employee Post
Reto,

From a privacy and security standpoint, I would not want my hosting company to go through my company’s email. Beyond that, I don't think it’s feasible for a system administrator to do that accurately.  

The reason SmarterMail is architected into System, Domain, and User level is to sandbox companies’ information but also allow them to configure things the way they want.  

Provide SpamFoo as another antispam feature as you have with all the other antispam settings you have added and changed over the years.  Do it in a similar fashion to how I suggested, and as your customers use their mail like they normally do, it will train for the domain, user, etc., inherently. 
Tim Uzzanti
CEO
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
David,

SpamFoo is no different than any other Antispam setting or feature we have added to SmarterMail over the years.  The only difference is that it gets better as Domain and Users use their mail.  Just like when you added a new RBL or URIBL or decided to give a weight to DKIM, you would do the same with SpamFoo.  Not that complicated.
Tim Uzzanti
CEO
SmarterTools Inc.
Jaime Alvarez Replied
@Nick Jansen adding to your comment... we add to the subject *spam* for emails that do not meet the threshold to be moved to Junk so people can still see them in their inbox, but obviously if they dont go to spam, they can't help training SpamFoo... so I think with all the false positives of SpamFoo (a lot btw),  SM could implement a  "Mark it as safe" or "Not spam" button? 
This would be very helpful.

Zach Sylvester Replied
Employee Post
Hey All, 

SpamFoo just let us know they pushed out a new update. The system should auto update but if you don't want to wait you can login to SmarterMail as a system admin then go to Settings->SpamFoo Dashboard Then expand System and go to status then scroll down and click update client. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Nick Jansen Replied
I clicked Run under Update Client and it almost immediately came back saying:
Last result: Success
Message: Client is up to date.

Am I actually already running the newest version? It says Client Version 0.7.102 farther up the System -> Status page, and all the Model Versions say 0.7.71.
Zach Sylvester Replied
Employee Post
Hey Guys, 

Version 0.7.102 is the newest version and 0.7.71 are the newest models they put out. @echoDreamz After SpamFoo updates it shuts itself down. If you go to Manage->Services You an manually start SpamFoo. SmarterMail will also start it automatically when it gets an email. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Nick Jansen Replied
OK thanks! Maybe either mine had already automatically updated earlier, or the manual update was really fast. I don't remember what the version numbers were before I clicked the button.

I also never saw the API error: 502 that others have reported, and my SpamFoo service seems to be running normally.
echoDreamz Replied
I just left it alone and it updated itself :)
Zach Sylvester Replied
Employee Post
Hey guys,

Thanks for the feedback.
I reached out to SpamFoo regarding this question, and they confirmed the following:
SpamFoo does learn on a per-user basis. When a user makes a correction, SpamFoo can apply semantic classification to that correction so that similar emails are handled appropriately for that user going forward.

The global model is designed to be generalized enough to catch common spam patterns that most users would consider unwanted. The per-user classification is intended to address the specific type of scenario you mentioned, where a message may be unwanted for one user but acceptable for another.

Kind regards,

Zach Sylvester

Software Developer
SmarterTools Inc.
Douglas Foster Replied
@Sabatino
It appears that:
  • if the domain admin posts a correction from the domain's message review screen, it creates a filtering rule for the domain.
  • If a user posts a correction from his personal review screen, it creates a filtering rule for that user
Hosting sites with many domains will probably want rules at the system level.
In the future, domain admins may want the ability to review user rules, and either generalize them or correct them.

(I have messages going to the Training folder where they are manually reviewed, and I have a real problem with people treating messages from management and essential vendors as Junk.  So I have a low view of user accuracy.)
Robert G. Replied
We were gertting bombarded with obvious spam like Lowes giftcards, free vacation marriot, etc... We host around 2k domains of customers with all different types of email flow. 

Since SpamFoo release it has been MUCH better than MessageSniffer and Cyren. Thank you to the team! 

One thing I'm trying to figure out is Spam Reporting / False Positive reporting. Most users do not use the SmarterMail interface. They use Outlook, or their phone. So, when they use native report as spam or junk no training happens.

How could we implement training for these users? Is there an API endpoint I can hit so I can have users forward emails to junk@domain.com and nojunk@domain.com then send the perspective messages to Spamfoo/SmaterMail? 

Spamfoo Stats since enabling below...
Email Hosting Provider
Robert G. Replied
@Sabatino if your theory is correct. How in the world are the big boys doing it? GMAIL, yahoo etc... Spam for 1 is typically spam for all. We host over 100k customers on various email platforms with SmarterMail being one of them. 

Most spam are user see is blatantly obvious stuff like H0m3dep0t gift cards, and newsletters they don't understand they can unsubscribe to. 
Email Hosting Provider
Tim Uzzanti Replied
Employee Post

Sebatino, 

Obviously, SpamFoo isn't going to disclose the complete inner workings of its product. If it did, it would be much easier for competitors to replicate. That said, they do provide a very good high-level explanation of how the system works on their website.

What we do know is that SpamFoo uses an incredibly sophisticated scoring system that accounts for a wide variety of scenarios. This allows the system to continuously learn and adapt to incoming email while enabling both servers and users to train it over time.

No single person can significantly influence the overall system—only their own experience. Likewise, each user's actions contribute to and influence the experience at the domain/server level. This approach allows the system to improve collectively while preventing any individual from disproportionately affecting the results.

I would suggest implementing it in one of two ways:

  1. If you're already using Cyren and MessageSniffer, add SpamFoo with a weight of 5. This allows it to provide an extra push for messages that are already trending toward spam based on your existing antispam scores. Once you're satisfied with the results and decide to remove Cyren and/or MessageSniffer, simply increase SpamFoo's weight accordingly.
  2. If you're not using Cyren or MessageSniffer, give SpamFoo a weight of 15 and allow SmarterMail's built-in antispam features to contribute the additional scoring needed to classify messages as spam.

A combination of Greylisting, DKIM, SPF, RBLs, and URIBLs is extremely beneficial to an overall antispam strategy when used alongside SpamFoo—or any other third-party antispam solution.

I'm using our default scoring weights as examples, realizing that many of you have heavily customized your scoring or use a completely different scoring model for your environment.

As SpamFoo continues to learn, it will become even more accurate. Unlike RBLs and many other antispam features, which can cause significant disruption if a legitimate domain is mistakenly listed—especially when assigned a high weight—SpamFoo's effectiveness improves over time rather than becoming more susceptible to those types of issues.

If you would like to continue discussing the inner workings, please start another thread so that we can discuss things at a higher level for the overall audience of this thread.

Tim Uzzanti
CEO
SmarterTools Inc.
Sabatino Replied
Thanks for the reply, Tim. Obviously, I didn't want to know the details of its internal workings; as a system administrator, I just want to better understand how to train it effectively. I’ll start a new discussion to delve into this further, so it can be useful to everyone. Thanks again.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Tim Uzzanti Replied
Employee Post
Robert,

Even when users move messages to and from the Junk folder in a client, SpamFoo is trained just as it would be if they were using Webmail. All of that information is anonymized. In addition, there is an Advanced Training option available in each user's Webmail settings that provides additional training capabilities. When enabled, it sends more of the raw message—minus any personally identifiable information—to improve training. This also works when users move messages using a client in addition to Webmail.

If you're concerned about false positives, start SpamFoo with a lower weight for a period of time. To be honest, that's how we implement any new antispam feature or solution. One could argue it's allot more valuable to give SpamFoo higher weights over time. 

Regarding any APIs our customers could use or any training folders that could be monitored, we'll need to get more information from SpamFoo.
Tim Uzzanti
CEO
SmarterTools Inc.
Sabatino Replied
Anyway, reading this page (https://help.smartertools.com/SmarterMail/Current/Topics/User/Email/spamfoo-dashboard-user-domain), it seems clear that it is integrated with the Junk folder. So, if a user moves an email from Junk to Inbox (or vice versa)—even via IMAP—Spamfoo learns from it... which is fantastic. I’d just like to understand how to handle this training at the system or server level.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

David Replied
> So, if a user moves an email from Junk to Inbox (or vice versa)—even via IMAP—Spamfoo learns from it... which is fantastic

Yes, but it learns only for that user. Learning here basically meaning "treat this sender as ham/spam", as far as I see it. And it doesn't seem to apply this newly learned stuff to other domain users. So, one user training heavily + most of users completely ignoring it (as it mostly happens in real life) will not help to improve overall - domain level or system level - spam detection. Unless there is something more going on in the background that we don't know. By training I mean moving to/from Junk, we mostly use IMAP clients.
Tim Uzzanti Replied
Employee Post
David,

Did you even read what I posted?  What you said is blatantly wrong!  If you saw a change by one user immediately impacting someone’s results, we would all be in a world of hurt.  The amount of math happening behind the scenes is fractional to ensure decisions SpamFoo makes are accurate.  

As you would expect, users see the fastest training; then domains and server; and then the overall SpamFoo models.

When we evaluated SpamFoo, we threw hundreds of thousands of messages at it to see how fast it would train various scenarios to see changes in SpamFoo behaviors.

Tim Uzzanti
CEO
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
Thought I'd share a cool stat. SpamFoo gives partners access to statistics for the licenses they've distributed. Since our release last Thursday, we'll have processed 10 million emails by the end of today. Pretty incredible start!
Tim Uzzanti
CEO
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
Nathan,

That isn't necessary and not how you should approach it.  Please read the various methods I've explained in this community by using low weights.   
Tim Uzzanti
CEO
SmarterTools Inc.
Bruce Replied
SpamFoo is ignoring trusted senders and moving their emails to the Junk folder.

I receive notification emails multiple times a day, and previously trusted senders meant these emails didn't go to Junk, even though DMARC fails with them, but SpamFoo is still moving these emails to Junk and ignoring the trusted sender status. 

Spam Score header below

X-SmarterMail-SpamAction: Medium | MoveToFolder
X-SmarterMail-TotalSpamWeight: 20 (Trusted Sender - User, DMARC: Failed)
X-SmarterMail-Spam: DMARC [failed]: 0, Reverse DNS Lookup [Passed]: 0, HONEYPOT [passed]: 0, Cyren [Unknown]: 0, CyrenIP [LOW]: 0, Message Sniffer [code:0]: 0, SPF [Pass]: 0, DKIM [Pass]: 0, _ARC: none, SpamCop: 0, HostKarma (Whitelist): 0, Spamhaus: 0, Barracuda (BRBL): 0, HostKarma: 0, UCEProtect Level 1: 0, SURBL: 0, Spamhaus (DBL): 0, SpamFoo [Spam,prob:0.64]: 20
David Replied
 Did you even read what I posted?  What you said is blatantly wrong!
@Tim Uzzanti Tim, sorry - I don't know the inner workings. I also said "as far as I see" and "unless there is something more going on in the background that we don't know", don't be angry.

Do I understand correctly now that training from one user will in fact help others on domain level, but only in a fraction of what it does to that users mailbox ? I completely missed that part.

Btw is there some page or some post where we can read a bit more about how this works.

terry Replied
I may be blind, but I can't find the dashboard for users:


Where in Webmail interface is this located?

Terry

Zach Sylvester Replied
Employee Post
@Bruce thank you for letting us know. 

I just opened a support ticket for you so support can review your server and work with spamfoo to try and resolve your issue. 

Kind Regards,

Zach Sylvester

Software Developer
SmarterTools Inc.
echoDreamz Replied
@bruce - Same here, way too many false positives. Mostly around marketing emails/promotional/newsletters, but even some from the US Social Security Administration. We have SpamFoo set to a very low score, so it's not impacting anything, but the number of false positives is wild.
echoDreamz Replied

I highly doubt any actual spam is coming from Office Depot, Mastercard or Allegiant. All of them have DKIM, SPF and DMARC setup, so spoofing is unlikely.

I verified almost all of the Mastercard emails, all of them are purchase confirmations from a POS system for card transactions. 

Allegiant appears to be mostly marketing emails for flights and points with their credit card, none of which are really "spam". 

It certainly seems to be too aggressive.
Zach Sylvester Replied
Employee Post
Hey @echoDreamz 

Thank you for that information. 
I reached out to SpamFoo and they are working on something that should reduce those kinds of false positives right now. I'll let you guys know when I get another update. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Linda Pagillo Replied
@Zach Sylvester I would say that both are undesirable, but from a consumer standpoint, I think a false-negative would be better than a false-positive. With a false-negative, you would still get the spam message in your inbox which people don't really want, but with a false-positive, you may miss an important email if it's sent to junk or deleted. Just my personal thoughts. 
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
Tim Uzzanti Replied
Employee Post
Linda,

And why I’ve suggested over and over again a low score should be used while enabling SpamFoo or any new Antispam solution or even a new RBL etc.
Tim Uzzanti
CEO
SmarterTools Inc.
Linda Pagillo Replied
@Tim Uzzanti I agree with you 100% :) We approach new anti-spam solutions, RBLs etc... this way as well. Once we fully test over a period of time, we increase or decrease scores based on our findings. It's the best way to implement something new in my opinion.
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
Gabriele Maoret - SERSIS Replied
Although Spamfoo seems to work quite well, unfortunately I had to temporarily disable it because it consumes too much CPU and tends to slow down the entire server...

This is a screenshot from a machine with a 16-core AMD Epyc 7313 processor, 200 domains, and a total of 1,200 users.

Note that this is a quiet period; SpamFoo's CPU usage sometimes hovers at 80-90% (leaving little for the rest of the system) for tens of minutes...





I set "Max Concurrency" to 3 because I receive over 25,000 emails a day.

Maybe I should lower it to 2 or even 1?

Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Gabriele Maoret - SERSIS Replied
I lowered it to 2, and now the CPU spikes seem more manageable (I see SPAMFOO-CLIENT.EXE using 15-25% on average with spikes around 50-55%)... Fingers crossed
Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Bruce Replied
We have already tried that, but we are using an Intel Xeon E-2468 8-core server, not a 16-core. It usually operates well below 10% CPU usage, so even with SpamFoo set to 2, as you have it, it spikes to 100% CPU usage.

Replacing the mail servers with 16-core CPUs means upgrading servers that are less than a year old and will also double Microsoft's monthly SPLA licensing costs for the mail servers just to operate Spamfoo. 

It might be better if SpamFoo AI modules use a GPU, as it might be faster and more efficient. This would also mean purchasing a GPU for the mail servers rather than replacing them. 
Sébastien Riccio Replied
Linux might come handy for the licensing issue.
Sébastien Riccio
System & Network Admin

Tim Uzzanti Replied
Employee Post
Bruce,

Keep in mind, when you enable SoamFoo, it works through all of the users’ inboxes and classifies existing emails. The ongoing CPU usage is normally negligible. It sounds like they’re going to incorporate GPU support as well. That will make it incredibly versatile. We explored Google Cloud GPU options in preparation to plan our testing. 

Tim Uzzanti
CEO
SmarterTools Inc.
terry fairbrother Replied
Since there's many spamfoo threads, I will add my thoughts to this one rather than start another.

I upgraded last night, it's a single domain so a straight forward setup. I turned off the routing rules, content filters and custom spam weights that I had in place to deal with the spam. I also set spamfoo to 30 from the start as I have a number of spam weights that are negative where the sender is trusted or use specific phrases within a reply. So far this morning I have had to do very little additional tweaking. It does seem that the negative weights are the ones helping with the false positives.

Things that I think would be of use (Dashboard)

Messages section -
    I don't need to know the IP, but would prefer the subject
    Auto refresh. Similar to RspamD or fixed auto refresh every 5 minutes
    A button which adds a false positive spam to a trusted sender list / rule or...

Senders section - 
    A button which adds a false positive email to a trusted sender list / rule

Rules and Protection section -
    Bulk import of trusted email addresses or domains

Also, the ability to block it from scanning an email address completely. I have content filters that deal with high weighted spam or redirects to the administrator@ accounts. It seems that spamfoo is scanning internal emails as it repasses through the spool and thus, the messages section is duplicated with the same 'spam / ham' email


Millennium Systems Replied
Seeing constant CPU spikes of 50%-60% as well on a 12 core Xeon server, 50-60k daily inbound messages, classification disabled. But it isn't causing the CPU to get maxed, so we'll continue to evaluate.

The CPU load is a factor in not turning on classification for all domains be default for the time being. Which brings me to some questions. As per the documentation the user's SpamFoo Dashboard is only available to users within a domain with classification enabled.

- Why? Potential CPU overload aside, customers that don't care for or want Gmail style folders are excluded from adjusting spam settings and rules?
- When not using classification does SpamFoo still learn HAM/SPAM when users marked message as spam or drag messages out of junk?
- These users can't clear the trained spam since there is no dashboard access?
Tim Uzzanti Replied
Employee Post
SpamFoo only uses CPU when it’s available to process the existing emails in users’ mailboxes across the server. It will not take resources from SmarterMail. As a user’s inbox is finished, classifications are visible in webmail along with access to the dashboard. 

Activity in the user’s account (moving messages into a different classification or moving something to junk or inbox) is how a user trains SpamFoo, not via dashboard.  When users use clients and move messages to junk or inbox, it will also train.  
Tim Uzzanti
CEO
SmarterTools Inc.
Merle Wait Replied
We use inbound gateways for emails.. then feeding the main mail server.
I get that SpammFoo uses the mailbox training - but is there anything we need to be doing with the inbound mail servers?  
kevind Replied
@Merle Wait Good question!

I started a new thread on that topic as many people take advantage of Inbound Gateways to offload spam processing from their primary mail server.
Millennium Systems Replied
Tim,

Thanks for the response and clarification. Does this mean that when SpamFoo is enabled in Anti-Spam but Classification is not, it still starts indexing all user mailboxes? And these CPU spikes should subside over time?
Marc Frega Replied
Does Spamfoo go through the archives as well?
Michael Replied
We have Spamfoo turned on for Antispam but not yet classification. In the Spamfoo dashboard we see Fail at the end of every Processing Steps chain. Why would it show a Fail here?
We can see in the logs that it's noted to be Spam.
Daniel Replied
this far i have to say that i am quite amazed of spamfoo (we get a lot of french, German + english mix of mails it categorises them quite well.
Also the "NotASpam" seems to work nicely (we have a mix of EMClient  +Outlook and some Webmail users, and i can say that even vor Outlook only users i see "selfcreated training rules" in the users space.
So the only thing that would be nice to know is pricing (we have had the "Cyren Premium Antispam" already so i am happy that they moved to something else)

(Approx 220 Users on  8CPU 32GB Ram VPS i am always below 30%CPU 25% RAM +- 2500mails inc/day 500mails out/day)
Zach Sylvester Replied
Employee Post
@Michael Thanks for the question. Fail at the end of the chain means that the email failed to get passed the checks thus went to spam. 
Hope this answers your question. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Derek Curtis Replied
Employee Post
@Daniel At this time, we don't have a good handle on pricing. However, we're anticipating it being in line with what we have currently for Cyren and Message Sniffer.
Derek Curtis
CCO
SmarterTools Inc.
Bastian Replied
That sounds good.

Hopefully the pricing will be a little more competitive than Cyren and Message Sniffer.
I think that would make it a very attractive option for many customers, including me.

-Bastian
Heimir Eidskrem Replied
We are seeing too many emails tagged as spam when they are not.  For us this needs some work to be useful.  Yesterday we had 3 emails from hbomax.com that went to 3 different users, same ip, same message.  2 listed not spam and 1 listed as spam.  Notifications from instagram and facebook are tagged as spam.  Emails from VW going to a VW dealership tagged as spam.  
But I think this might be a good solution in the future, just too much false positives now and missing features Im sure they will add.   Looking forward to see where this goes.

example  same email. 

07/24/2026, 09:44:31 AMbounce.email.hrtrainonline.com13.111.174.46email
Not Spam
Promotions
07/24/2026, 09:44:30 AMbounce.email.hrtrainonline.com13.111.174.48email
Spam
Spam
echoDreamz Replied
@Heimir Eidskrem I agree, the false positives are wild and very inconsistent. For us, the biggest one is facebookmail.com - Spamfoo says 84.2% messages are spam (friendupdates@facebookmail.com) which are all nothing more than friend requests, tags and general facebook activity.
Zach Sylvester Replied
Employee Post
@Heimir Eidzkrem 
The reason for that specifically is that user most likely moved a message like that to junk. If you look at the Spamfoo dashboard look for tabsknn that means user preference was the reason it went to junk. 

Kind Regards,

Zach Sylvester

Software Developer
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
echoDreamz,

The problem is, people are actually correcting that domain equally. I included a graph from the dashboards we have access to that aggregate data across licenses of our customers so that we can support you. Cyren and Message Sniffer flag these messages randomly based on rules that sometimes change, as do the messages. That is why with those products, will always end up in ham or spam randomly.   

With SpamFoo, people can actually train their experiences.  I'm going to chalk up the complaints as some of you are not understanding how more beneficial SpamFoo is than other spam products.  SpamFoo is allowing users, servers, and overall models to learn at scale and individually.  When combined with proper weights and other spam checks included within SmarterMail, it is the gateway to controlling your mail completely and eliminating the randomness we have all been a custom to.  

Tim Uzzanti
CEO
SmarterTools Inc.
What weights do you recommend? Overall and to Spamfoo?

I find that the weights system is a weird one overall... and should be done in some other way.
Tim Uzzanti Replied
Employee Post
Weights have been around since SmarterMail 1.0, and we rarely have complaints because it is simple and flexible, that simplifies even further down to users in the way of Low, Medium, and High. It kind of feels like people just want to complain about something which doesn't help this thread. Let’s focus on solving problems, not creating them.

Add SpamFoo to the existing mix of Antispam configurations you already have. We only gave SpamFoo a weight of 5 or so. This helped messages that were on the bubble of being SPAM previously; the extra weight of SpamFoo would push them into Junk. We saw very few false positives.

Things that didn't get pushed into Junk, we just moved to Junk via (clients or Webmail), which trained SpamFoo. After a week or two, we started increasing SpamFoo weights and decreasing other weights until we eliminated Cyren and Message Sniffer altogether and then re-optimized the weights for the functionality we provide in SmarterMail itself, like RBLs and URIBs we use. 

The result, we didn't miss anything. We trained SpamFoo on our mail and now we have little to no SPAM. And, this is how any new Antispam feature should be added, even if its a new RBL.

Hope this helps,
Tim Uzzanti
CEO
SmarterTools Inc.
Heimir Eidskrem Replied
@Zach Sylvester 
Where in the dashboard will I find that?
Thanks Zach
Jane Noel Replied
I've been using AI to analyze my log files and what it's telling me is that Cyren and Spamfoo seems to be the best combination. There's only about 2% that Message Sniffer catches that the other two miss. I have had the same issues others talk about with false positives, but once we've identified those, I've had no complaints from customers.
Zach Sylvester Replied
Employee Post
@Heimir Eidskrem If you look at the dasboard under messages you should see something that says KNN next to the Spam or not Spam verdict for each message. 

Let me know if you find it. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
Jane,

I'm guessing SpamFoo is catching much more than Cyren in that analysis.  In our analysis, Cryen and Message Sniffer are incredibly disappointing, and that’s why we were moving on.  In addition, by using SpamFoo, each user gets to define how their mail looks.  In old-school concepts, all users must live with the rules assigned by "someone".  With SpamFoo, everyone gets to curate their email exactly how they want it.  As you can see by the post I made from FacebookMail, people were equally thinking it was HAM and SPAM.  With SpamFoo, a person who thinks it’s Spam, it will be Spam.  If a person thinks a message is a promotion, it will be a promotion.  It won't change and be something else because that is how it’s been trending for others.
Tim Uzzanti
CEO
SmarterTools Inc.
Jaime Alvarez Replied
I agree with you in the fact that Spamfoo is much better than Message Sniffer... And It's very positive that each user 'trains' its spam so its more personalized, but a) Spamfoo should have a more reliable 'baseline' and b) it should learn faster I guess. 

In our case, all the noreply@zoom.us emails sending valid emails on zoom information on meetings, alerts, are treated as spam by Spamfoo giving them a very high score. 
We have been using the "Move to Inbox" option daily on these emails and they are still being treated as spam by Spamfoo.  [Spam,prob:0.93] No other filter is marking them as spam, only Spamfoo.
Tim Uzzanti Replied
Employee Post
Jamie,

If a user moves a message from SPAM or to INBOX, that user will see that change moving forward. It’s the upstreams that take a while.  

In regards to Zoom specifically, SpamFoo implemented an entirely new reputation system for domains and IP's which will resolve issues like Zoom ever being shown as spam again unless Zoom was an open relay for a while, and then SpamFoo would start to slowly untrust it. From the sounds of it, this will be coming this week or next.  

From our tech meetings with them, it seems their mentality was to allow users to define the model (primarily), but because people still move Zoom emails to SPAM (when they do mass emails), it had a tendency to affect valid emails from Zoom-type companies. With the reputation system, they are basically setting specific companies at certain trust levels while still allowing users to shape the model. Moving to Spam on companies with certain trust levels will go slower or faster.  

SpamFoo is a new business and technology, and that’s why we have been taking it slowly with them and why they have agreed to the BETA. Your input and our input have been priceless, and this new reputation system in my mind is likely the final thing I believe they really needed. 

For us, SPAM was so bad even with numerous SPAM solutions enabled, we didn't mind some additional training with SpamFoo to get to the level of success we are seeing today.

Many of the users on here didn't see it that way. Because of that, we have been working very closely with SpamFoo, and it has evolved very quickly. Within a couple of weeks, users should have an even better baseline, and then training will require less. And, the nice thing about any training users have already done still applies. It is a slick technology actually solving the problem of SPAM, especially how we integrated it into SmarterMail.  
Tim Uzzanti
CEO
SmarterTools Inc.
Heimir Eidskrem Replied
@Zach Sylvester 
Thanks Zack,
I have not seen that yet.  
I assume you are referring to the Decision column in the messages  display.
Like "Not Spam Reputation allow"  it will says "Not Spam KNN" ?????
Zach Sylvester Replied
Employee Post
@Heimir Eidskrem 
Thanks for getting back to me. 
Yes, that is correct here is what it looks like. 



Let me know if you have any questions. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Heimir Eidskrem Replied
@Zach Sylvester 
Thank you so much for that.
I apricate you sharing any kind of knowledge that you think we should have.  This is a new tool I dont know how to use yet. I find the spamfoo concept very different and not sure I understand or agree with everything.

Based on what Tim wrote earlier it sounds that we are now letting the users decide whats spam vs actually have to unsubscribe from what they signed up for.  Its like everything is spam if the user think it is. Not sure if its anything wrong with that and I see many good things about doing that.  

How does that work?  
A user gets notifications from instagram or facebook.  They dont want it or doesnt know better so they drag it to the junk mail folder.  Does that train spamfoo for that user only or does that action goes beyond that user?  

Tim Uzzanti Replied
Employee Post

Heimir,

I enjoy explaining how SpamFoo works because it's unique, and I believe it's going to solve the spam problem. Any adjustments a user makes immediately affect that user's email from that point forward. To me, that's probably the single best thing about SpamFoo: a user can completely eliminate spam and organize their email without waiting for updates or scheduled rule changes. At the same time, each adjustment gradually helps train the upstream system, resulting in improvements to the various models that are then distributed to everyone.

The concern you raised about users potentially impacting reputation was recently addressed with a reputation system that has been in testing and is expected to be released soon. In my opinion, this was the last major piece they needed. It has  reduced the occasional false positives and resolves scenarios like FacebookMail which users were almost equally marking as spam and ham. 

If I sound excited about SpamFoo, it's because spam has been the bane of our existence, in support and just personally. I receive 300 to 400 spam messages every weekday (it drops significantly on weekends). Before SpamFoo, more than 100 of those messages would make it through Cyren, Message Sniffer, rspamd, RBLs, and our other layers of protection. At the same time, because we had so many spam-filtering solutions in place to achieve acceptable results, we also experienced a significant number of false positives because too many factors could contribute to a message's score.

Today, I'm lucky if I see more than a few spam messages in my inbox each day. We've been able to remove Cyren, Message Sniffer, and rspamd entirely, while still using some RBLs and other internal features within SmarterMail
Tim Uzzanti
CEO
SmarterTools Inc.
Heimir Eidskrem Replied
@Tim Uzzanti 
Thank you for your response.  
Spamfoo is interesting and Im learning more on how it works so Im a bit excited too.  I admit I have to learn much more about spamfoo to have an opinion and understand how this will work for us.  Today I am just observing how it works and see what the reports says. 
I do not want a system that quarantines potential spam for manual review like some others so spamfoo has potential.

Looking forward to see how this goes. 
Tim Uzzanti Replied
Employee Post

Our sample of organizations, both small and large, is highly representative of the industry. System administrators don't have the time to act as the spam engine, although there are a few long-time customers in this community who seem to enjoy micromanaging it.

In today's fast-paced environment, most organizations simply don't have the time for that. AI has become remarkably effective because it's continuously being trained by human users. As a result, it increasingly makes decisions the way an experienced human would, while doing so far more quickly and consistently.

I would overlook legitimate emails in the 100+ spam messages that would get through each day.  But now, I've even turned on email notifications on my phone again, which I had to previously disable because of all the spam. Its made a world of difference for me. 

Tim Uzzanti
CEO
SmarterTools Inc.
BMark Replied
Hello,

Yes, I agree with you @Heimir Eidskrem and @Tim Uzzanti
I'm also very enthusiastic about the Spamfoo, but I still need to fully understand how it works and how to manage it. (Tim, when and if possible, let us know when there's a good guide with instructions, because reading the community isn't easy to follow.)

I understand quarantining spam is a very time-consuming operation, and it's not optimal. In fact, it should only be used in the initial phase to train the systems and have a "quick" way to release false-positive messages, which would otherwise take a long time.

If the system learns and acts on its own, it would be a great thing!

Mark
Would be awesome if we could edit rules. Right now we have to start over on the rule if we want to add wildcards to domains

John Quest Replied
I enjoy explaining how SpamFoo works because it's unique, and I believe it's going to solve the spam problem.

A huge gigantic cautionary flag there. Having been involved in the war on spam and other malicious activity and nefarious actors for 25 years, I can safely say there is no such thing as "solve the spam problem."

Remember the age old but still relevant saying, build a higher wall, someone will build a taller ladder.

All things internet and spam and malicious actors is dynamic and ever changing and evolving. 

Yes, absolutely, there are new and improved and helpful tools and software to help fight the war on nefarious actors, but at the heart of the problem is human nature and attitudes and ideologies. Unless you find a way to change all of those attitudes, the war will always be there.
Tim Uzzanti Replied
Employee Post
Brian,

In the build that we have, which has the reputation system, rules can be edited. Whenever they decide to release this upcoming build, is when you will get it.
Tim Uzzanti
CEO
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
John,

300 to 400 spam messages each weekday to my account, and 100+ would get through with Cyren, Message Sniffer, and rspamd along with some SM features enabled.  With SpamFoo and some SM features, I have two or three spam messages in my mailbox per day.  I consider my SPAM issues solved and I think many others would as well.  In addition, we have also been able to protect our employees with the phishing emails as well.  As soon as we hire a new employee and they update LinkedIn, they often receive emails asking for personal information using my name and information.  We no longer see those phishing emails now because SpamFoo is blocking them.  This has been our experience with a variety of domains we manage and now we’re seeing customers have similar results.
Tim Uzzanti
CEO
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
All,

We have been notified that a new SpamFoo client is being released today. We’re going to need to find a way to notify customers like we do with our products since SpamFoo evolves their product(s) much more often than other antispam companies do.

The updated SpamFoo client is 0.7.127.  It includes GPU support, editing for rules, non-ASCII fixes, a fix for a caching issue for rules for how they display, introduction of the reputation system, and other minor bug fixes. 

From the sounds of it, this is the first version of the reputation system, and there is more to come.

We have tested the GPU support and with a Nvidia 4060 and can process 50x the messages than CPU-only.  We are now going to be testing various GPU’s on Google Cloud to see how things perform.  

In the end, we won’t be using GPU support.  We find SpamFoo to process a significant amount of messages with very low CPU usage and it will only use the CPU when it’s available.  It has NEVER impacted SmarterMail in all the environments we manage. On initial implementation when it’s going through all mailboxes, SpamFoo will use whatever CPU is available (SmarterMail has the CPU priority) so that it can process all user mailboxes as fast as possible. 

Hope this helps,
Tim Uzzanti
CEO
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
All,

In addition to this update, we’ve been informed that SpamFoo will be releasing a variant of their Daemon that can run externally, similar to rspamd and Spamassassin.  We will need to add support for this as we did for the others.  This will be highly beneficial for those who like to separate the spam and mail service roles, but even better for those who want to utilize GPUs to process an enormous volume of messages and get the most out of their hardware. 


Tim Uzzanti
CEO
SmarterTools Inc.
kevind Replied
OK, so when SpamFoo releases the new client today, do we need to do anything?  Will it automatically update on our production server?  Or do we need to wait until the next build of SmarterMail?
Tim Uzzanti Replied
Employee Post
SpamFoo will update itself. 
Tim Uzzanti
CEO
SmarterTools Inc.
LAtest client downloaded.

API error 502 and this in the dashboard.

Had to delete the spamfoo folder on the server in C:\Program Files (x86)\SmarterTools\SmarterMail\Service

It wiped all rules and everything in the dashboard.

Fresh start....
Getting this in the smartermail dashboard

Derek Curtis Replied
Employee Post
Both of those are likely due to the update -- they will (or would) eventually have spun back up. That said, SpamFoo is aware of the delay and they're working on a fix. 

Deleting the SpamFoo folder probably wiped all the server and domain rules, but they can be recovered if you still have that folder. Simply stop SmarterMail, replace the folder, and start SmarterMail back up. 

As an aside, user corrections are kept at the user level, so those would remain. 
Derek Curtis
CCO
SmarterTools Inc.
They dont show anywhere after the folder delete and initial restart.
John Quest Replied
Had to delete the spamfoo folder on the server in C:\Program Files (x86)\SmarterTools\SmarterMail\Service

It wiped all rules and everything in the dashboard.

Standard practice is to make a copy or backup of a folder before deleting it.
Derek Curtis Replied
Employee Post
All,

Based on how much activity SpamFoo has had in the community and all the questions and interest we are getting in support, we are adding a category specifically for SpamFoo in the community. In addition, this thread has run the gamut of different types of discussion topics, many of which have been answered or fixed. So we'll be locking this thread.

Any current SpamFoo topics will be moved over to the new category, and we ask that any future question, discussion, or issue related to SpamFoo be started in that category.
Derek Curtis
CCO
SmarterTools Inc.
Derek Curtis Replied
Employee Post
As an aside, we started a ticket with Brian on his issue. 
Derek Curtis
CCO
SmarterTools Inc.