A comprehensive spam protection design

Idea shared by Douglas Foster - Today at 10:47 AM

Proposed

I have never seen anyone articulate a formal description of what an email filtering system should do, but then email did not exist when I was in school. Our custom filtering environment has evolved to include features that seem pretty comprehensive, and our rate of spam-getting-through rate is pretty tiny and getting smaller. I am sharing this list to help others decide whether they need these capabilities as much as we do. If so, maybe some vendor will step up to the challenge.

Firewall

Enforces country blocking
Enforces abusive IP address blocking

First Inbound Gateway (Sender Filtering)

Blocks a few IP addresses, HELO domains, and SMTP domains using SmarterMail features.
Detects invalid recipients and quickly discards messages with no valid recipients, but does so without enabling directory harvesters
Performs verification tests on identifiers:
- Forward-confirmed DNS for Helo and Reverse DNS,
- Enhanced SPF for SMTP From,
- Enhanced DMARC for message From.
Performs reputation checks based on 6 identifiers and their verification state:
- Source IP,
- Helo,
- Reverse DNS
- SMTP From
- Message From
- Reply-To
Perform proxy authentication and reputation checks based on 5 identifier pairs:
- Verified Source IP + SMTP From
- Verified Helo domain + SMTP From
- Verified Reverse DNS domain + SMTP From
- Verified SMTP From + Message From
- Verified Message From + Reply-To
Based on the above tests, any unauthenticated messages are routed to Quarantine.
Perform relationship checking
- Detect known clients, vendors, and employees based on corporate databases
- Detect known correspondent organizations
- Detect known correspondent mailbox provider accounts
- Send Unknown senders to quarantine
Quarantine messages that use emojis and other Unicode in the subject line, but enforcement is conditional on sender identity.
Check configured blacklists and stop at first match.
Enforce allowed sender restrictions for specific recipients.
(Planned) Conditionally call SpamFoo to evaluate messages from unknown senders. This minimizes the risk of false positives while maximizing protection from high-risk senders.
Store message metadata in a SQL database.

Barracuda Appliance (Quarantine Review and Content Filtering)

Provides quarantine management interface
Performs malicious URL filtering and other content tests
Checks Barracuda reputation blacklist

Allowed Message Gateway (optimization tasks)

Conditionally rewrites Friendly Name to prevent deception, especially on cell phones
Conditionally inserts a customized External Sender Warning
For transactional attachments to specific accounts, extracts the attachment to a network directory for further processing. (DMARC reports and fax-via-email.)
Stores message metadata in a SQL database.
Matches allowed message metadata to raw message metadata for accept/reject analysis, taking into account the cumulative effect of all blocks and all quarantine releases.

Training Folder (user feedback)

Manually process submissions and choose disposition:
- Unsubscribe user
- Block sender
- Ignore submission

Back to Community Threads

Please leave this box unchecked

Reply to Thread

Enter the verification text