topic Re: What is everyone using for anti-spam? in General Topics

What is everyone using for anti-spam?

bjdraw — Fri, 27 Jan 2012 14:24:13 GMT

Sorry if this is inappropriate here, but I figure who else better to ask than other Palo Alto Networks customers.

As much as I love our PANs, unlike some other firewalls, they don't really help with spam. So I'm wondering if other users would mind sharing their success stories.

Our current solution is GFI Vipre Email Security on the Exchange 2010 server and we're up for renewal and would prefer to move in the direction of an appliance or other off Exchange solution.

Re: What is everyone using for anti-spam?

fnichelson — Fri, 27 Jan 2012 17:02:57 GMT

We use a Barracuda 400 to filter all incoming and out going email.

We peek at 7000,000 email messages in an 24 hours on some days but average 300,000 messages most days. As with all Spam filters nothing is 100% proof but its does the job very well for us.

Re: What is everyone using for anti-spam?

mikand — Fri, 27 Jan 2012 21:48:06 GMT

There are all sort of solutions depending on your needs, taste and size of wallet 🙂

I have over the years been playing with for example Ironport which is nice but really expensive.

What it comes down to in terms of anti-spam is a combination of actual contents of the email in combination with some kind of "reputation" filtering (mails sent from known spamsources will get a higher point of probability of being a spammail).

Another thing to not ignore is the possibility of false positives.

A common setup is to use "reputation" filtering to simply drop connections from wellknown spamsources and then forward the rest to the client but tag the subject (or so) with [Possible Spam] or similar so the client can then have a rule to place those mails in their own folder (this will also ease the needs for administration from the IT-department to all the time scan for mails that shouldnt be dropped/quarantined or for that matter people who wants their mail to get released from the quarantine - the later will of course still exist if your email policy is to not allow executables to be sent through and stuff like that).