» For students  » IT Ressources at IHA  » Mail  » Spam information 

Spam information

 

IHA has a spam filter the mail server. This means that all e-mails are scanned to help determine if it is spam.

 

The determination is made through three phases. An e-mail is rejected right away if it fails one of the tests, and the following tests are not made. The sender of the e-mail will always get an information about this.

 

The three phases are:

 

Sender

If the machine which dispatched the e-mail is blacklisted, the mail is rejected. The sender will always get a message regarding this, if the sender has a valid e-mail-address.

 

Greylisting

The mail servers' first attempt to deliver an e-mail is rejected by our spam-filter with the message that it has been "grey-listed". Correctly configured mail servers will retry delivering the mail after a period of time, and since its now on the grey-list it is accepted by the spam-filter. The clever thing in this setup is that most of the spam is sent through bots that doesn't control if the message was delivered and therefor does not resend it. If they do not resend it, it will never be delivered.

 

The disadvantage about grey-listing is a slight delay, when receiving e-mails from new senders you have not received mail from before; in practice maybe up to 30 minuts. When the first e-mail has been received, all future mails from that sender will be received without delay.

 

If you are interested in more information about grey-listing visit http://www.greylisting.org/.

 

Content

The text in the subject and the body of the mail is read and compared to a database with known spam characteristics. This could be e.g. obvious danger signals like the words "Viagra", "Penis enlargement" etc. The spam-filter also checks for a large number of less obvious spam signs that are compared, e.g. random letters ”kbnæstgvælksrfrftæhcæ”, or hidden HTML-code in the e-mail.

 

How does the system mark SPAM?

An e-mail can contain several suspicious characteristics. For every "hit" a number of points are given, e.g. 2.5 points for the word ”Viagra”, 2.7 for ”Penis enlargement” and 1.3 for gibberish in the bottom of the mail.

 

This e-mail has now reached a score of 6.5 which in our case will be marked as spam. The e-mail will be rejected and the sender will receive a message concerning this.

 

How about the e-mails that slip through?

There will always be spam-e-mails that slip through. We cannot allow a too aggressive filtering, since there might be situations where legitimate mails contain words like viagra etc.

 

It's always a balance between how many spam-e-mails the filter lets through and how many legitimate e-mails it rejects. The amount of spam that slips through is of course proportional with the amount that gets in, i.e. if a lot of spam is sent to an address, more will slip through.

 

Therefore, use your email address carefully, and do not list your email address on webpages which you do not fully trust.

30-06-2011/kgj