ISMail Anti-spam

ISMail supports multiple levels of filtering to reduce spam, including IP-based filtering, content-based filtering, and heuristic filtering. Used together, these filters can reduce spam by over 90%.

IP-based filters are generally very fast, and stop possible spam before it is received by the mail server. Content-based filters scan messages after they are received but before they are delivered to email accounts. Heuristic filters work in the middle ground between pure IP-based and pure content-based filtering.

IP-based Anti-spam Filters:

• Trusted IPs: trusted IPs are used to always accept messages based upon the IP address of the sender (a type of 'whitelist'). These IP addresses are designated as known and legitimate mail sources.

• Blocked IPs: blocked IPs are used to always reject messages basd upon the IP address of the sender (a type of 'blacklist'). These IP addresses are designated as known and non-legitimate mail sources.

• RBL/ORL/Internet Filters: real-time blackhole lists (RBLs), open-relay lists (ORLs), and internet filters (other lists) are used to accept or reject messages based upon the IP address of the sender. These lists are maintained by internet-based servers that are queried with the IP address of a message sender; they respond with an 'accept' or 'reject' indicator, depending upon whether the IP is present in their databases. Some of these filters can be used free of charge, and others are subscription-based.

Content-based Anti-spam Filters:

• Content Filters: content filters are used to accept or reject messages based on whether message header or body content matches a set of patterns associated with spam. These patterns can be system-defined (default content filters), mail admin defined (custom global or custom domain-level filters), or user-defined (custom user filters). Content filters can also be used to identify and delete messages marked with special headers (such as from Collaborative Filters) with minimal processing.

Heuristic Filters

• Greylist Filters: greylist filters lie between pure IP-based filters and content-based filters. They are used to temporarily block reception of messages if the IP address of the sender, name of the sender, and name of the sender recipient have not been seen before. Most mail servers will retry sending a greylisted message a short time later, resulting in a small delivery delay. However, most spam is not retried at all, resulting in a decrease of spam messages.

ISMail Anti-spam Defense System

ISMail integrates up to 6 levels of spam blocking.

Because no single method is effective at filtering all spam, ISMail uses a combination of internal, collaborative, and configuration-specific techniques to help provide spam-free mailboxes.

Level 1: Network connections are refused from all 'Blocked IPs'. If an IP is blocked, the sender can not even establish a network link to ISMail.

Level 2: Blacklists are scanned to determine if the sender IP, domain name, or account name are banned. If so, ISMail returns an error to the sender before any mail is transferred. (Whitelists are also consulted to determine if the sender is known-good, in which case mail can immediately be transferred).

Level 3: Reverse DNS checking is performed to determine if the sender is trying to hide its identity. If so, ISMail returns an error to the sender before any mail is transferred.

Level 4: Real-time blackhole lists (RBLs) are consulted to determine if the sender IP is a known source of spam. If so, ISMail returns an error to the sender before any mail is transferred.

Level 5. Greylist processing is activated to determine if the sender is 'known' to the receiver. If not, ISMail returns an error to the sender, indicating that it must retry sending at a later time; this discourages 'hit-and-run' spam attacks.

Level 6: Content filtering is performed to compare messages with known patterns of spam. If a match occurs, the message is deleted or flagged for further processing by an email client filter.