SpamFoo thus far
Problem reported by echoDreamz - 6/28/2026 at 2:22 PM
Submitted
It's been about 15 hours so far, I’ve seen legitimate emails from American Express (credit limit increase notification), Amazon (purchases and subscription notifications), Duolingo, Temu order updates, Booking.com offers, several known clothing Company marketing emails, various legit emails from WorkDay, and Realtor listing change alerts incorrectly flagged as spam by SpamFoo.

It has however correctly identified several phishing attempts and is effectively catching a large volume of spam, particularly from low-quality TLDs such as .space and similar domains.

Resource usage shows the spamfoo-client.exe process consuming approximately 270MB of RAM and averaging 1–3% CPU usage, with periodic spikes up to 47%. The initial startup exhibited a higher CPU spike, I assume data loading and initialization.

Network activity is minimal and primarily consists of DNS queries to internal DNS servers, along with connections to 192.68.130.30 (rdap-1.verisigndns.com). This traffic appears to be related to domain/RDAP or WHOIS-style lookups.
Matt Petty Replied
Employee Post
Thanks for the update, insanely valueable information thank you. 
Matt Petty
Senior Software Developer
SmarterTools Inc.
echoDreamz Replied
Yeah, so far, it's working, just a bit concerning about the false positives. Still seeing a lot from legit businesses, mainly newsletter type emails, but also transactional emails, banking emails etc.
Tim Uzzanti Replied
Employee Post
We would love to see some examples.  Also, any moving of those messages to and from junk and or classifications will make immediate improvements.  Keep in mind, even legit emails have some spam score but it’s the weight you associate to them that matters and truly decides what is spam or not.
Tim Uzzanti
CEO
SmarterTools Inc.
echoDreamz Replied
Ill get you a sample :)
Bruce Replied
Same here. Far too many false positives and missed spam emails with SpamFoo.

Cryen and Message Sniffer work better for us, so we really hope that SmarterTools are not planning to replace Cryen and Message Sniffer with SpamFoo for those who have paid for these add-ons. SpamFoo should be added as another option rather than a replacement. 

Any chance SmarterTools could confirm that Cryen and Message Sniffer will remain options and that SpamFoo will not replace them? In reading some of the posts from Tim, it seems that SpamFoo might be replacing these, which I hope is not what is going to happen. 
THinking that SM wants to be a part of people paying for spamfigthing options... and there is no reason that those money shouldnt go to SM instead for Cyren and Message Sniffer.
Bruce Replied
We have now also had to completely disable both Email Classification and SpamFoo Anti-spam.

We have 7,000 mailboxes, and after over 48 hours of the 8-core Xeon CPU running 5 Ghz and a minimum of 60% usage continuously, it has classified only 200 mailboxes with a setting of 20,000 max inbox messages.

Many that it had been classified did not have the Classification folders in the inboxes. It looks like it has to reclassify when emails are received, or there is some bug that means it's not always showing the Classification folders. 

With the queue many months long, it is never going to complete, and will just end up with an expensive electricity bill from the CPU running at full throttle without any benefit.

With SpamFoo anti-spam enabled and Email Classification disabled, the CPU spikes to 80% each time emails are received, which is every 10 seconds or so, and we get many false positives. It looks like on a busy web server, AI classification, even if it worked properly, is simply not feasible on CPU alone.

Hopefully, SmarterTools will be able to fix the issues with both SpamFoo anti-spam and Email Classification, as we had such high hopes after reading Tim's posts. It's a shame that neither is working as it should.
Gabriele Maoret - SERSIS Replied
I see the same problem with "Classification"...
Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Matt Petty Replied
Employee Post
If you still wish to use classification without back-scanning there is also a number near where Email classification is enabled for controlling how many messages into the inbox we'll go for classifications right now this is set to a very high value, I'd set this to either 0 or a low value like 100 for now to get around the "months" issue.

We'll be taking in all this feedback and I'm sure there will be more posts throughout the day. 

For now, there is a lot of information and data to look through, cheers all, got a lot of work to do.

P.S. set the spam weight accordingly if you aren't confident but still wanna see it "perform" you can try setting the weight to 0. I'll say based on our internal testing and anecdotes spam gets pretty hectic Monday morning.
Matt Petty
Senior Software Developer
SmarterTools Inc.
terry Replied
This has been working fairly well f9r us so far, running on linux and not a lot of users.

One thing I would really like to see is more info in the dashboard. Message subject would be nice to see, and when clicking on the message for detail show some of the email text. This would allow us to verify spam a lot quicker than having to login and browse to spam folder to verify spam.

A little more info in the header entries would also be nice.

Terry

David Replied
Been running it since morning... after figuring out how to start it. About 100 messages, didn't mark a single one as SPAM. There were a few that look like mass sales emails, should have marked them. But maybe it can only deal with English text ? I don't really know how it works. Will leave it on for a week and see.
Matt Petty Replied
Employee Post
SpamFoo does have the technical capability with it's underlying "embedding" model, this is how it turns an email into something the models can train against.

We are addressing an issue right now with how we're loading our models when running on a non en-US server. Stay tuned on this, leave it off for now if it's causing you issues but the way it's designed shouldn't break delivery if it has issues (same with all the other antispam providers).
Matt Petty
Senior Software Developer
SmarterTools Inc.
Bruce Replied
Thank you for your response, Matt. I tried setting the Email Classification to 0, but it only classifies mailboxes that contain 0 messages. I don’t see any other options for controlling how many messages should be included in the inbox for classification.

Matt Petty Replied
Employee Post
Thanks for that note Bruce. 
I'm gonna write that down to discuss that functionality, I feel like it should do X of all inboxes but we'll dial in that behavior.
For now this would mean that all NEW emails would get classified for everyone still, but you can disable this option to hide the option from user's if you're worried about them wondering where there stuff is.
Matt Petty
Senior Software Developer
SmarterTools Inc.
Bruce Replied
Thanks for the reply, Matt. I will leave it for now and check again in the next SM release. 
Matt Petty Replied
Employee Post
SpamFoo DOES have the technical capability to scan multi-lingual emails. SpamFoo uses a multi-lingual embedding model, this is effectively how it turns an email into a bunch of numbers that can be trained on that models understand.

There is an issue with the client not running correctly (locale issues) when running in some environments. Stay tuned, should have something about this.
Matt Petty
Senior Software Developer
SmarterTools Inc.
Zach Sylvester Replied
Employee Post
Hey @Reto

If you move the emails out of junk to your inbox it will send SpamFoo a correction so they can improve their models. It will also immediately improve your local system as Spamfoo as an local correction system meaning corrections take immediate effect. 

Kind Regards,

Zach Sylvester

Software Developer
SmarterTools Inc.
Zach Sylvester Replied
Employee Post
Hey @Reto

Thank you for getting back to me. Do you think you could open a ticket and send a zip file with some of your false positives then we can share some of the data with spamfoo? If you could share emails that do not contain PII or just modify the emls so they dont contain PII that would be great. We will also review them and make sure they dont contain any PII.

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Nick Jansen Replied
@Zach
1. Does that model improvement method work both directions (Junk to Inbox, and Inbox to Junk)?
2. What about moving an email from Junk directly to another folder (not the Inbox), like ones that users create to sort their incoming email?
3. Does this work for any client (including Outlook via MAPI), or just Webmail?
Tim Uzzanti Replied
Employee Post
Nick,

1) Yes
2) No, but will be changing in the near future.
3) Yes, any client. 

Tim Uzzanti
CEO
SmarterTools Inc.
Nick Jansen Replied
Thanks Tim!
David Replied
Hi Tim,
Can you confirm this to work for IMAP as well (if IMAP client moves something from Inbox to Junk or the other way around) ?

Thanks,
David
Craig Edmonds Replied
I would like to thank everyone for their input and experience with this.

I "was" eager to do the upgrade, but might hold off a little longer. The classification folders feature looks interesting.
Gabriele Maoret - SERSIS Replied
I have updated and (after the new SpamFoo release) it seems to work quite well.

The only thing is that SpamFoo is not so good with Italian emails (a lot of false positeves), so I set the score to 5 for now...
Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Tim Uzzanti Replied
Employee Post
Gabriele,

I'm glad to see you reduced the score and are giving it a little time.  SpamFoo learns quickly, and if you and some of your users do some training and reclassifications, the results will be amazing.  

As we move past this rollout, we will be going into more details about best practices from our new Adaptive Intrusion Detection, Greylisting, DKIM, and some internal spam checks in conjunction with SpamFoo.   

I've got mail accounts on a variety of servers and services, and the amount of SPAM is out of control.  We’re really looking forward to helping our customers and your customers have a very different experience.  
Tim Uzzanti
CEO
SmarterTools Inc.
terry Replied
We also had to reduce the weight to 5 and enable our old spam checks. the number of false positives are too high. I do like the idea of this product, but it still needs some work.

As per my previous post. the dashboard needs to have more info and control over spam. Being able to move spam to the inbox from the dashboard would be a huge bennefit.

have also noticed a few emails being flagged as spam when we have added the domain to the Rules list as Not Spam.

Terry



Tim Uzzanti Replied
Employee Post
Terry,

The SpamFoo dashboard has no connection to SmarterMail. The dashboard is showing you all the work that SpamFoo has done and allows you to control the settings for rules, phishing, etc., that will be processed on future emails that come to your inbox. 
Tim Uzzanti
CEO
SmarterTools Inc.
terry Replied
Okay, but the dashboard shows from and to address's and Ip's, so it has access to info. Would still like to see the Subject of the email. and some message body when clicking on detail. It is time consuming checking Junk Folders to see if they are legit spam or false positives.

Terry

Tim Uzzanti Replied
Employee Post
Terry,

We will pass the reqeust onto SpamFoo. Since the messages were processed on that server, I’m not sure why they couldn't show it. And, they have a Gateway service that they are going to be releasing as well, and my guess is, they would probably need that information there as well.  

Thanks,
Tim Uzzanti
CEO
SmarterTools Inc.
echoDreamz Replied
Matt, since I cant seem to respond to your DM... here are the Spamfoo logs around the time that the Amex email went thru...


2026-06-28 04:33:20.333 +00:00 [WRN] [2bbe37b1ca6c0d5b] Escalation triggered - Margin: 0.312, Entropy: 0.484, Disagreement: 0.928
2026-06-28 04:33:20.355 +00:00 [INF] Recorded classification: Spam (category: spam) from welcome.americanexpress.com via ML


2026-06-28 04:33:20.333 +00:00 [WRN] [2bbe37b1ca6c0d5b] Escalation triggered - Margin: 0.312, Entropy: 0.484, Disagreement: 0.928


2026-06-28 04:33:20.014 +00:00 [INF] [2bbe37b1ca6c0d5b] Loading IANA RDAP bootstrap data from https://data.iana.org/rdap/dns.json
2026-06-28 04:33:20.019 +00:00 [INF] [2bbe37b1ca6c0d5b] Start processing HTTP request GET https://data.iana.org/rdap/dns.json
2026-06-28 04:33:20.020 +00:00 [INF] [2bbe37b1ca6c0d5b] Sending HTTP request GET https://data.iana.org/rdap/dns.json
2026-06-28 04:33:20.156 +00:00 [INF] [2bbe37b1ca6c0d5b] Received HTTP response headers after 136.6854ms - 200
2026-06-28 04:33:20.157 +00:00 [INF] [2bbe37b1ca6c0d5b] End processing HTTP request after 137.1654ms - 200
2026-06-28 04:33:20.195 +00:00 [INF] [2bbe37b1ca6c0d5b] Start processing HTTP request GET https://rdap.verisign.com/com/v1/domain/americanexpress.com
2026-06-28 04:33:20.195 +00:00 [INF] [2bbe37b1ca6c0d5b] Sending HTTP request GET https://rdap.verisign.com/com/v1/domain/americanexpress.com
2026-06-28 04:33:20.297 +00:00 [INF] [2bbe37b1ca6c0d5b] Received HTTP response headers after 101.7304ms - 200
2026-06-28 04:33:20.297 +00:00 [INF] [2bbe37b1ca6c0d5b] End processing HTTP request after 102.2499ms - 200
2026-06-28 04:33:20.360 +00:00 [INF] Setting HTTP status code 200.
2026-06-28 04:33:20.362 +00:00 [INF] Request starting HTTP/1.1 POST http://localhost:16253/classify-stream - null 49799
2026-06-28 04:33:20.363 +00:00 [INF] Executing endpoint 'HTTP: POST /classify-stream => ClassifyEmailStream'
2026-06-28 04:33:20.363 +00:00 [INF] Writing value of type 'FinalPrediction' as Json.
2026-06-28 04:33:20.368 +00:00 [INF] Executed endpoint 'HTTP: POST /classify-stream => ClassifyEmailStream'
2026-06-28 04:33:20.368 +00:00 [INF] Request finished HTTP/1.1 POST http://localhost:16253/classify-stream - 200 null application/json; charset=utf-8 2998.9161ms
2026-06-28 04:33:20.871 +00:00 [INF] [e7c4189c18c38c4d] Start processing HTTP request GET https://rdap.verisign.com/com/v1/domain/indeed.com
2026-06-28 04:33:20.871 +00:00 [INF] [e7c4189c18c38c4d] Sending HTTP request GET https://rdap.verisign.com/com/v1/domain/indeed.com
2026-06-28 04:33:20.926 +00:00 [INF] [e7c4189c18c38c4d] Received HTTP response headers after 55.0107ms - 200
Linda Pagillo Replied
Hi @SmarterTools team!

Just some feedback. I'm running the latest version of SM on a test server that I set up to be a spamtrap. I'm have a lot of spam going to that server etc... I'm noticing that SpamFoo is working pretty well, but it is marking a lot of messages as not spam even though Message Sniffer and Declude are scoring them high enough to be classified as spam (over weight 30). In other words, possible false negatives on SpamFoo's part. Would you like me to open a ticket with you guys and submit some headers so you can have a look? Or would you prefer I do something else to get some samples to you? Thanks! 
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
Gabriele Maoret - SERSIS Replied
yeah, we need an option to eneble SpamFoo on per Domain basis (if not better Per User...)
Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Tim Uzzanti Replied
Employee Post
Reto,

That is why you should start with lower spam weights with ANY new Antispam solution you use. Some old Antispam products with just rules don’t need as much exposure to your mail, but they also don't perform very well.  Any of the new Antispam products that are AI-based drastically change over time.  

Thanks,
Tim Uzzanti
CEO
SmarterTools Inc.
Linda Pagillo Replied
Thanks @Reto 

I'm having more of an issue with false negatives than I am with false positives right now I think. I need to dig deeper into it to see if I'm getting any/many false-positives.
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
Tim Uzzanti Replied
Employee Post
Reto,

How we implemented SpamFoo.

Added SpamFoo to the existing mix of Antispam configurations we already had. We only gave SpamFoo a weight of 5 or so.

For messages that were on the bubble of being SPAM previously, the extra weight of SpamFoo would push them into Junk. We saw very few false positives.

Things that didn't get pushed into Junk, we just moved to Junk via (clients or Webmail), which trained SpamFoo.

After a week or two, we started increasing SpamFoo weights and decreasing other weights until we eliminated Cyren and Message Sniffer and then re-optimized the weights with the functionality we provide in SmarterMail.  

The result, we didn't miss anything. We trained SpamFoo on our mail and now we have little to no SPAM.

Hope this helps. 
Tim Uzzanti
CEO
SmarterTools Inc.
David Replied
I have to agree with others about false positives. I've had important business mails marked as spam by SpamFoo, this is not good.

Since my rule to move them to Junk folder when score is above 30 they didn't get moved to Junk, which is both good and bad. It's good because we didn't miss these emails. Then it's bad because: how do we train the algorithm if the message doesn't get moved to Junk first, so we can move it back to Inbox, in order to train the thing. I'd actually need to configure the system to move every message that SpamFoo flags as spam to Junk first (which I obviously don't want to do, not sure anyone would want to) but that's what is needed to make training possible. And training is apparently something one can't do without.

So I'll ask a blunt question: what's the plan about this ?
Knowing this system sends various metrics back to you... well, please enlighten me before I slip on the wrong track and start thinking you're using the beta to train the system in the field before it hits production :)
David Replied
No really, what should we do in order to make this thing useful... Have everything moved to Junk and educate all users to check Junk folder and train the thing manually - you have to agree that this is not feasible. Is there some other way I am not seeing ?
Tim Uzzanti Replied
Employee Post
Reto,

From a privacy and security standpoint, I would not want my hosting company to go through my company’s email. Beyond that, I don't think it’s feasible for a system administrator to do that accurately.  

The reason SmarterMail is architected into System, Domain, and User level is to sandbox companies’ information but also allow them to configure things the way they want.  

Provide SpamFoo as another antispam feature as you have with all the other antispam settings you have added and changed over the years.  Do it in a similar fashion to how I suggested, and as your customers use their mail like they normally do, it will train for the domain, user, etc., inherently. 
Tim Uzzanti
CEO
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
David,

SpamFoo is no different than any other Antispam setting or feature we have added to SmarterMail over the years.  The only difference is that it gets better as Domain and Users use their mail.  Just like when you added a new RBL or URIBL or decided to give a weight to DKIM, you would do the same with SpamFoo.  Not that complicated.
Tim Uzzanti
CEO
SmarterTools Inc.
Nick Jansen Replied
For messages that SpamFoo marks as spam but the message's total score doesn't meet the threshold for being moved to the Junk folder, maybe SpamFoo could be made to learn that the message probably wasn't considered spam by the recipient by keeping track of it for a bit and seeing if the user doesn't move it to the Junk folder on their own within a certain (perhaps configurable) period of time?

I guess a mailbox that isn't checked often could unintentionally generate a lot of incorrect false positive reports by doing that though.
Jaime Alvarez Replied
@Nick Jansen adding to your comment... we add to the subject *spam* for emails that do not meet the threshold to be moved to Junk so people can still see them in their inbox, but obviously if they dont go to spam, they can't help training SpamFoo... so I think with all the false positives of SpamFoo (a lot btw),  SM could implement a  "Mark it as safe" or "Not spam" button? 
This would be very helpful.

Zach Sylvester Replied
Employee Post
Hey Guys, 

We just heard back from SpamFoo and they are going to be releasing an updated model soon that addresses some of the feedback that you all submitted. I will post another update when they let us know they pushed it. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Zach Sylvester Replied
Employee Post
Hey All, 

SpamFoo just let us know they pushed out a new update. The system should auto update but if you don't want to wait you can login to SmarterMail as a system admin then go to Settings->SpamFoo Dashboard Then expand System and go to status then scroll down and click update client. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Linda Pagillo Replied
@Zach Sylvester Hi Zach. When I updated the client, I received an API error: 502 and the service would not start back up. I had to restart the SmarterMail service to get SpamFoo to start. Just wanted to let you know :) Thanks!
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
echoDreamz Replied
Same, cant update. Get an API error: 502.
Nick Jansen Replied
I clicked Run under Update Client and it almost immediately came back saying:
Last result: Success
Message: Client is up to date.

Am I actually already running the newest version? It says Client Version 0.7.102 farther up the System -> Status page, and all the Model Versions say 0.7.71.
Zach Sylvester Replied
Employee Post
Hey Guys, 

Version 0.7.102 is the newest version and 0.7.71 are the newest models they put out. @echoDreamz After SpamFoo updates it shuts itself down. If you go to Manage->Services You an manually start SpamFoo. SmarterMail will also start it automatically when it gets an email. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Nick Jansen Replied
OK thanks! Maybe either mine had already automatically updated earlier, or the manual update was really fast. I don't remember what the version numbers were before I clicked the button.

I also never saw the API error: 502 that others have reported, and my SpamFoo service seems to be running normally.
echoDreamz Replied
I just left it alone and it updated itself :)
Sabatino Replied
bump 
yeah, we need an option to eneble SpamFoo on per Domain basis (if not better Per User...)
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Sabatino Replied
I remain of the opinion that an anti-spam system running on a server hosting multiple domains needs to be adaptive—capable of learning—at both the system level and the domain level.

I realize it’s complex, but if the same server hosts an insurance company's domain, an e-commerce site selling supplements, and a hotel's domain, I find it hard to imagine that a single, general training process for the entire server would be effective.

Honestly, I’m not even sure if such a scenario can be resolved.

That said, it is absolutely essential to be able to enable Spamfoo at least at the domain level, so that users from specific domains can be involved in the initial training phase.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Sébastien Riccio Replied
I tend to agree with @Sabatino .

I don't really see how a single learning model can work well on a server hosting multiple businesses with completely different activities.

For example, imagine one domain is a car parts retailer. Its users will regularly report emails selling "miracle pills" as spam. On the same server, another domain belongs to a pharmacy that legitimately exchanges emails about medications with suppliers every day. If both domains feed the same Bayesian / IA classifier, their training data will inevitably influence each other. At some point, there is a risk that legitimate pharmacy emails could be scored less favorably because another tenant has effectively taught the classifier that this type of content is usually spam.

I also wonder whether, ideally, learning could even be done per user rather than only per domain. Even within the same company, users in purchasing, accounting, HR, or sales often receive very different kinds of email, so what is considered legitimate can vary from one user to another.

Of course, I realize that's much easier said than done, and there are probably good reasons why it isn't that simple.

That's also why we configure the Bayes classifier in our Rspamd-based incoming gateway per domain rather than globally. It has worked well for us and avoids one domain's training influencing another's.

Kind regards
Sébastien Riccio
System & Network Admin

Zach Sylvester Replied
Employee Post
Hey guys,

Thanks for the feedback.
I reached out to SpamFoo regarding this question, and they confirmed the following:
SpamFoo does learn on a per-user basis. When a user makes a correction, SpamFoo can apply semantic classification to that correction so that similar emails are handled appropriately for that user going forward.

The global model is designed to be generalized enough to catch common spam patterns that most users would consider unwanted. The per-user classification is intended to address the specific type of scenario you mentioned, where a message may be unwanted for one user but acceptable for another.

Kind regards,

Zach Sylvester

Software Developer
SmarterTools Inc.
Sébastien Riccio Replied
Hello Zach,

That's great to hear this has been taken into account when designing the product.
Congrats to the team.

Kind regards.
Sébastien Riccio
System & Network Admin

Sabatino Replied
Stop, stop.
But this is even more confusing.
If spamfoo trains at the user level, who does the general training?
Does every single user always start over? So we'll never get rid of false positives/negatives.

I might think that if a user's training is 1 for themselves, it's 0.1 for the general model.
But it doesn't solve the same problem... so the users most inclined to train influence the entire server.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Douglas Foster Replied
@Sabatino
It appears that:
  • if the domain admin posts a correction from the domain's message review screen, it creates a filtering rule for the domain.
  • If a user posts a correction from his personal review screen, it creates a filtering rule for that user
Hosting sites with many domains will probably want rules at the system level.
In the future, domain admins may want the ability to review user rules, and either generalize them or correct them.

(I have messages going to the Training folder where they are manually reviewed, and I have a real problem with people treating messages from management and essential vendors as Junk.  So I have a low view of user accuracy.)
Robert G. Replied
We were gertting bombarded with obvious spam like Lowes giftcards, free vacation marriot, etc... We host around 2k domains of customers with all different types of email flow. 

Since SpamFoo release it has been MUCH better than MessageSniffer and Cyren. Thank you to the team! 

One thing I'm trying to figure out is Spam Reporting / False Positive reporting. Most users do not use the SmarterMail interface. They use Outlook, or their phone. So, when they use native report as spam or junk no training happens.

How could we implement training for these users? Is there an API endpoint I can hit so I can have users forward emails to junk@domain.com and nojunk@domain.com then send the perspective messages to Spamfoo/SmaterMail? 

Spamfoo Stats since enabling below...
Email Hosting Provider
Robert G. Replied
@Sabatino if your theory is correct. How in the world are the big boys doing it? GMAIL, yahoo etc... Spam for 1 is typically spam for all. We host over 100k customers on various email platforms with SmarterMail being one of them. 

Most spam are user see is blatantly obvious stuff like H0m3dep0t gift cards, and newsletters they don't understand they can unsubscribe to. 
Email Hosting Provider
Sabatino Replied
I'll start by saying I haven't installed the latest version yet. My server primarily handles summer tourism domains, and right now is peak traffic for these businesses in Italy. Since I don't need any urgent fixes, I won't install the new version until the end of the season (September).

That said, I thought I'd gathered from the messages here on the community that the training also relies on the junk and inbox folders. So much so that some users asked if it also worked with IMAP and SM, and I think I understood that it did.

Now, however, I have some doubts about this too. Are those who haven't enabled junk mail for scores above xxx not participating in the training? Or, if everything ends up in the inbox, it distorts the entire training.


Let's be clear.
Far be it from me to criticize spamfoo, which I hope works. I'm just trying to understand how to best use it.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Tim Uzzanti Replied
Employee Post

Sebatino, 

Obviously, SpamFoo isn't going to disclose the complete inner workings of its product. If it did, it would be much easier for competitors to replicate. That said, they do provide a very good high-level explanation of how the system works on their website.

What we do know is that SpamFoo uses an incredibly sophisticated scoring system that accounts for a wide variety of scenarios. This allows the system to continuously learn and adapt to incoming email while enabling both servers and users to train it over time.

No single person can significantly influence the overall system—only their own experience. Likewise, each user's actions contribute to and influence the experience at the domain/server level. This approach allows the system to improve collectively while preventing any individual from disproportionately affecting the results.

I would suggest implementing it in one of two ways:

  1. If you're already using Cyren and MessageSniffer, add SpamFoo with a weight of 5. This allows it to provide an extra push for messages that are already trending toward spam based on your existing antispam scores. Once you're satisfied with the results and decide to remove Cyren and/or MessageSniffer, simply increase SpamFoo's weight accordingly.
  2. If you're not using Cyren or MessageSniffer, give SpamFoo a weight of 15 and allow SmarterMail's built-in antispam features to contribute the additional scoring needed to classify messages as spam.

A combination of Greylisting, DKIM, SPF, RBLs, and URIBLs is extremely beneficial to an overall antispam strategy when used alongside SpamFoo—or any other third-party antispam solution.

I'm using our default scoring weights as examples, realizing that many of you have heavily customized your scoring or use a completely different scoring model for your environment.

As SpamFoo continues to learn, it will become even more accurate. Unlike RBLs and many other antispam features, which can cause significant disruption if a legitimate domain is mistakenly listed—especially when assigned a high weight—SpamFoo's effectiveness improves over time rather than becoming more susceptible to those types of issues.

If you would like to continue discussing the inner workings, please start another thread so that we can discuss things at a higher level for the overall audience of this thread.

Tim Uzzanti
CEO
SmarterTools Inc.
Sabatino Replied
Thanks for the reply, Tim. Obviously, I didn't want to know the details of its internal workings; as a system administrator, I just want to better understand how to train it effectively. I’ll start a new discussion to delve into this further, so it can be useful to everyone. Thanks again.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Tim Uzzanti Replied
Employee Post
Robert,

Even when users move messages to and from the Junk folder in a client, SpamFoo is trained just as it would be if they were using Webmail. All of that information is anonymized. In addition, there is an Advanced Training option available in each user's Webmail settings that provides additional training capabilities. When enabled, it sends more of the raw message—minus any personally identifiable information—to improve training. This also works when users move messages using a client in addition to Webmail.

If you're concerned about false positives, start SpamFoo with a lower weight for a period of time. To be honest, that's how we implement any new antispam feature or solution. One could argue it's allot more valuable to give SpamFoo higher weights over time. 

Regarding any APIs our customers could use or any training folders that could be monitored, we'll need to get more information from SpamFoo.
Tim Uzzanti
CEO
SmarterTools Inc.
Sabatino Replied
Anyway, reading this page (https://help.smartertools.com/SmarterMail/Current/Topics/User/Email/spamfoo-dashboard-user-domain), it seems clear that it is integrated with the Junk folder. So, if a user moves an email from Junk to Inbox (or vice versa)—even via IMAP—Spamfoo learns from it... which is fantastic. I’d just like to understand how to handle this training at the system or server level.
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

David Replied
> So, if a user moves an email from Junk to Inbox (or vice versa)—even via IMAP—Spamfoo learns from it... which is fantastic

Yes, but it learns only for that user. Learning here basically meaning "treat this sender as ham/spam", as far as I see it. And it doesn't seem to apply this newly learned stuff to other domain users. So, one user training heavily + most of users completely ignoring it (as it mostly happens in real life) will not help to improve overall - domain level or system level - spam detection. Unless there is something more going on in the background that we don't know. By training I mean moving to/from Junk, we mostly use IMAP clients.
Tim Uzzanti Replied
Employee Post
David,

Did you even read what I posted?  What you said is blatantly wrong!  If you saw a change by one user immediately impacting someone’s results, we would all be in a world of hurt.  The amount of math happening behind the scenes is fractional to ensure decisions SpamFoo makes are accurate.  

As you would expect, users see the fastest training; then domains and server; and then the overall SpamFoo models.

When we evaluated SpamFoo, we threw hundreds of thousands of messages at it to see how fast it would train various scenarios to see changes in SpamFoo behaviors.

Tim Uzzanti
CEO
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
Thought I'd share a cool stat. SpamFoo gives partners access to statistics for the licenses they've distributed. Since our release last Thursday, we'll have processed 10 million emails by the end of today. Pretty incredible start!
Tim Uzzanti
CEO
SmarterTools Inc.
Nathan McKAy Replied
Can I have email to train it on once we make the jump? Ala, is it possible to store up alot of safe email, upgrade it, and then train it that such is acceptable on a domain level?
Tim Uzzanti Replied
Employee Post
Nathan,

That isn't necessary and not how you should approach it.  Please read the various methods I've explained in this community by using low weights.   
Tim Uzzanti
CEO
SmarterTools Inc.
Bruce Replied
SpamFoo is ignoring trusted senders and moving their emails to the Junk folder.

I receive notification emails multiple times a day, and previously trusted senders meant these emails didn't go to Junk, even though DMARC fails with them, but SpamFoo is still moving these emails to Junk and ignoring the trusted sender status. 

Spam Score header below

X-SmarterMail-SpamAction: Medium | MoveToFolder
X-SmarterMail-TotalSpamWeight: 20 (Trusted Sender - User, DMARC: Failed)
X-SmarterMail-Spam: DMARC [failed]: 0, Reverse DNS Lookup [Passed]: 0, HONEYPOT [passed]: 0, Cyren [Unknown]: 0, CyrenIP [LOW]: 0, Message Sniffer [code:0]: 0, SPF [Pass]: 0, DKIM [Pass]: 0, _ARC: none, SpamCop: 0, HostKarma (Whitelist): 0, Spamhaus: 0, Barracuda (BRBL): 0, HostKarma: 0, UCEProtect Level 1: 0, SURBL: 0, Spamhaus (DBL): 0, SpamFoo [Spam,prob:0.64]: 20
Bruce Replied
We have been testing SpamFoo extensively over the past five days, but there has been no improvement in false positives. With 200 to 500 emails received every five minutes, the CPU usage has increased from under 10% to spikes that reach 100% every few seconds when SpamFoo's anti-spam is active. This is problematic for us. 

Cryen and Message Sniffer are effective for us. A previous post by Tim mentioned replacing them with SpamFoo. Could you please confirm if this change will happen? We would really prefer to keep Cryen and Message Sniffer and not have SpamFoo. 
David Replied
 Did you even read what I posted?  What you said is blatantly wrong!
@Tim Uzzanti Tim, sorry - I don't know the inner workings. I also said "as far as I see" and "unless there is something more going on in the background that we don't know", don't be angry.

Do I understand correctly now that training from one user will in fact help others on domain level, but only in a fraction of what it does to that users mailbox ? I completely missed that part.

Btw is there some page or some post where we can read a bit more about how this works.

terry Replied
I may be blind, but I can't find the dashboard for users:


Where in Webmail interface is this located?

Terry

Sabatino Replied
Sorry @tim
It's not a criticism... I don't quite understand.

Please tell me if these statements are true.
1) The user trains himself
2) The domain, to some extent, also
3) In a minor mode, the entire server

The domain administrator can train the domain through his control panel...

But can I, the server administrator, do anything to train the server?
Sabatino Traini
      Chief Information Officer
Genial s.r.l. 
Martinsicuro - Italy

Zach Sylvester Replied
Employee Post
@Bruce thank you for letting us know. 

I just opened a support ticket for you so support can review your server and work with spamfoo to try and resolve your issue. 

Kind Regards,

Zach Sylvester

Software Developer
SmarterTools Inc.
echoDreamz Replied
@bruce - Same here, way too many false positives. Mostly around marketing emails/promotional/newsletters, but even some from the US Social Security Administration. We have SpamFoo set to a very low score, so it's not impacting anything, but the number of false positives is wild.
Zach Sylvester Replied
Employee Post
Hey @echoDreamz,

Thank you for providing your feedback! 
SpamFoo is still in the beta phase so it will get better over time. 
One question that I kind of have for everyone is what is better a false positive or a false negative?
Would it be better if SpamFoo implemented some kinda sensitivity filter? As they get more training data and the more you use it the better it will get but this is just something i've been curious about. 

Kind Regards,  

Zach Sylvester

Software Developer
SmarterTools Inc.
echoDreamz Replied

I highly doubt any actual spam is coming from Office Depot, Mastercard or Allegiant. All of them have DKIM, SPF and DMARC setup, so spoofing is unlikely.

I verified almost all of the Mastercard emails, all of them are purchase confirmations from a POS system for card transactions. 

Allegiant appears to be mostly marketing emails for flights and points with their credit card, none of which are really "spam". 

It certainly seems to be too aggressive.
Zach Sylvester Replied
Employee Post
Hey @echoDreamz 

Thank you for that information. 
I reached out to SpamFoo and they are working on something that should reduce those kinds of false positives right now. I'll let you guys know when I get another update. 

Kind Regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Linda Pagillo Replied
@Zach Sylvester I would say that both are undesirable, but from a consumer standpoint, I think a false-negative would be better than a false-positive. With a false-negative, you would still get the spam message in your inbox which people don't really want, but with a false-positive, you may miss an important email if it's sent to junk or deleted. Just my personal thoughts. 
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
echoDreamz Replied
Agreed with Linda. Both are equally bad.
Tim Uzzanti Replied
Employee Post
Linda,

And why I’ve suggested over and over again a low score should be used while enabling SpamFoo or any new Antispam solution or even a new RBL etc.
Tim Uzzanti
CEO
SmarterTools Inc.
Linda Pagillo Replied
@Tim Uzzanti I agree with you 100% :) We approach new anti-spam solutions, RBLs etc... this way as well. Once we fully test over a period of time, we increase or decrease scores based on our findings. It's the best way to implement something new in my opinion.
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
Gabriele Maoret - SERSIS Replied
Although Spamfoo seems to work quite well, unfortunately I had to temporarily disable it because it consumes too much CPU and tends to slow down the entire server...

This is a screenshot from a machine with a 16-core AMD Epyc 7313 processor, 200 domains, and a total of 1,200 users.

Note that this is a quiet period; SpamFoo's CPU usage sometimes hovers at 80-90% (leaving little for the rest of the system) for tens of minutes...





I set "Max Concurrency" to 3 because I receive over 25,000 emails a day.

Maybe I should lower it to 2 or even 1?

Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Bruce Replied
This is the same reason we eventually gave up on SpamFoo anti-spam and email classification. They both consumed far too much CPU when classifying emails on a busy mail server with 2,100 domains and around 7,000 mailboxes.

With 200 to 500 emails received every 5 minutes, the CPU would keep spiking to 100% every few seconds, and even trying to enable Email Classification on 3 smaller mail domains was taking over 5 hours, with the CPU at over 60% the whole time.

Spamfoo may work well for SmarterMail servers with a small number of mailboxes, but at the moment, unless a way can be found to lower the CPU usage, it doesn't work for larger or busier mail servers. 
Gabriele Maoret - SERSIS Replied
I lowered it to 2, and now the CPU spikes seem more manageable (I see SPAMFOO-CLIENT.EXE using 15-25% on average with spikes around 50-55%)... Fingers crossed
Gabriele Maoret - Head of SysAdmins and CISO at SERSIS
Currently manages 7 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 6 on-premise for customers who prefer to have their mail server in-house)
Bruce Replied
We have already tried that, but we are using an Intel Xeon E-2468 8-core server, not a 16-core. It usually operates well below 10% CPU usage, so even with SpamFoo set to 2, as you have it, it spikes to 100% CPU usage.

Replacing the mail servers with 16-core CPUs means upgrading servers that are less than a year old and will also double Microsoft's monthly SPLA licensing costs for the mail servers just to operate Spamfoo. 

It might be better if SpamFoo AI modules use a GPU, as it might be faster and more efficient. This would also mean purchasing a GPU for the mail servers rather than replacing them. 
Sébastien Riccio Replied
Linux might come handy for the licensing issue.
Sébastien Riccio
System & Network Admin

Zach Sylvester Replied
Employee Post
Hey @Bruce

We heard that SpamFoo is going to be incorporating GPU support for SpamFoo soon. 
I will let you know when I get another update regarding this. 

Kind regards, 

Zach Sylvester

Software Developer
SmarterTools Inc.
Tim Uzzanti Replied
Employee Post
Bruce,

Keep in mind, when you enable SoamFoo, it works through all of the users’ inboxes and classifies existing emails. The ongoing CPU usage is normally negligible. But, as Zach said, it sounds like they’re going to incorporate GPU support as well. That will make it incredibly versatile. We explored Google Cloud GPU options in preparation to plan our testing. 

Tim Uzzanti
CEO
SmarterTools Inc.
terry fairbrother Replied
Since there's many spamfoo threads, I will add my thoughts to this one rather than start another.

I upgraded last night, it's a single domain so a straight forward setup. I turned off the routing rules, content filters and custom spam weights that I had in place to deal with the spam. I also set spamfoo to 30 from the start as I have a number of spam weights that are negative where the sender is trusted or use specific phrases within a reply. So far this morning I have had to do very little additional tweaking. It does seem that the negative weights are the ones helping with the false positives.

Things that I think would be of use (Dashboard)

Messages section -
    I don't need to know the IP, but would prefer the subject
    Auto refresh. Similar to RspamD or fixed auto refresh every 5 minutes
    A button which adds a false positive spam to a trusted sender list / rule or...

Senders section - 
    A button which adds a false positive email to a trusted sender list / rule

Rules and Protection section -
    Bulk import of trusted email addresses or domains

Also, the ability to block it from scanning an email address completely. I have content filters that deal with high weighted spam or redirects to the administrator@ accounts. It seems that spamfoo is scanning internal emails as it repasses through the spool and thus, the messages section is duplicated with the same 'spam / ham' email


Millennium Systems Replied
Seeing constant CPU spikes of 50%-60% as well on a 12 core Xeon server, 50-60k daily inbound messages, classification disabled. But it isn't causing the CPU to get maxed, so we'll continue to evaluate.

The CPU load is a factor in not turning on classification for all domains be default for the time being. Which brings me to some questions. As per the documentation the user's SpamFoo Dashboard is only available to users within a domain with classification enabled.

- Why? Potential CPU overload aside, customers that don't care for or want Gmail style folders are excluded from adjusting spam settings and rules?
- When not using classification does SpamFoo still learn HAM/SPAM when users marked message as spam or drag messages out of junk?
- These users can't clear the trained spam since there is no dashboard access?
Tim Uzzanti Replied
Employee Post
SpamFoo only uses CPU when it’s available to process the existing emails in users’ mailboxes across the server. It will not take resources from SmarterMail. As a user’s inbox is finished, classifications are visible in webmail along with access to the dashboard. 

Activity in the user’s account (moving messages into a different classification or moving something to junk or inbox) is how a user trains SpamFoo, not via dashboard.  When users use clients and move messages to junk or inbox, it will also train.  
Tim Uzzanti
CEO
SmarterTools Inc.
Merle Wait Replied
We use inbound gateways for emails.. then feeding the main mail server.
I get that SpammFoo uses the mailbox training - but is there anything we need to be doing with the inbound mail servers?  
kevind Replied
@Merle Wait Good question!

I started a new thread on that topic as many people take advantage of Inbound Gateways to offload spam processing from their primary mail server.
Millennium Systems Replied
Tim,

Thanks for the response and clarification. Does this mean that when SpamFoo is enabled in Anti-Spam but Classification is not, it still starts indexing all user mailboxes? And these CPU spikes should subside over time?

Reply to Thread

Enter the verification text