Small Business Server antispam

[oldboy47]

Anybody recommend a effective antispam programme for use on a small business server (2003)?

Most recommended solutions I've seen are for single PC's and the 'enterprise' type solutions are way over the top.

Thanks in advance.

[peterb]

Spamassasin? There is a guide here (pretty old though)

http://www.spamblogging.com/archives/000069.html

or the Spamassassin site

http://spamassassin.apache.org/

[madman045]

We resell either Exclaimer (which is very well priced for SBS) or mxsweep for an external solution, again not very expensive.

http://www.exclaimer.com/Pricing.aspx

SBS Suite is priced per server, so it includes all your users and it has more than just antispam

http://www.mxsweep.com/

All incoming and outgoing mail through their servers, configure your firewall to only allow their IP and it will knock spam on the head

You pay per mailbox per month, so you can have five users, but if they have multiple addresses, you still only pay for five users

[Zak33]

the trouble with filitering it on your server is that you have to have it on the server to filter it.

Whivh means you've already downloaded it.. and it's already killing your bandwidth.

Plus your server is having to check it all for virus's and actually sort the spam anyway. If you get a lot of spam.. it's a killer. And your server has to have the uptodate anti virus on the button.. which never ever happens.. so when a new nasty hits the wires, you could get it before you ever get the antivirus update to sort it.

You need Postini... now owned by Google.

http://www.google.co.uk/postini/inde...m_term=postini

It's a managed solution outside of your infrastructure... get your mail sent to postini's servers, then they send the good stuff to you. You pay per mail box per month.

Your bandwidth will improve dramatically. They get the latest antivirus definitions before anyone else and only need them once.

You get spam boxes to check, online and you can whitelist or blacklist the good or bad.

And it's NOT Message Labs. Thankfully.

(guess what I used to sell.......)

[chadders]

^^what he said makes sense, I know our company uses ORF just as another to look at if that helps.

[badass]

the trouble with filitering it on your server is that you have to have it on the server to filter it.

Whivh means you've already downloaded it.. and it's already killing your bandwidth.

Bit misleading that. I use mailmarshal. When you use DNSRBL's, appx 95% of your spam gets bounced before its even started being downloaded. Should you choose to use reverse lookups, the false positives goes up as a few people don't configure their email servers properly but looking through our stats, over 97% of spam would have been blocked by that. Also, spam is much smaller than normal email by necessity.

[peterb]

Bit misleading that. I use mailmarshal. When you use DNSRBL's, appx 95% of your spam gets bounced before its even started being downloaded. Should you choose to use reverse lookups, the false positives goes up as a few people don't configure their email servers properly but looking through our stats, over 97% of spam would have been blocked by that. Also, spam is much smaller than normal email by necessity.

Yes, if all mail servers were properly configured, life would be easier - although I can understand why many aren't, especially if they are hosting mail accounts with multiple domain names and/or vhosts. I have tried filtering mail on helo and domain/IP links (using a postfix mailserver) but it generates too many false positives. But strict filtering on headers would be ideal!

[Moby-Dick]

Bit misleading that. I use mailmarshal. When you use DNSRBL's, appx 95% of your spam gets bounced before its even started being downloaded. Should you choose to use reverse lookups, the false positives goes up as a few people don't configure their email servers properly but looking through our stats, over 97% of spam would have been blocked by that. Also, spam is much smaller than normal email by necessity.

They might be smaller in size but its still taking up edge server and network bandwidth to acknowldge and bounce the mail. Not to mention the ability to block Directory Harvest by using offsite antispam.

[badass]

They might be smaller in size but its still taking up edge server and network bandwidth to acknowldge and bounce the mail. Not to mention the ability to block Directory Harvest by using offsite antispam.

Whilst there is a higher overhead having your antispam solution internally, network bandwidth concerns due to the reasons I mentioned above are small enough to be insignificant. Also, the effect on edge servers is minimal as memory and processing power is pretty cheap these days.
I am certainly not against using an external antispam solution - far from it, but the picture painted by Zak33 is far worse that it actually is in the real world.

[Moby-Dick]

since when was the picture painted by any security vendor fully accurate

[badass]

since when was the picture painted by any security vendor fully accurate

True