Re: Spam filtering at SMTP-time
> > I'm loking for shared folders so I can offer global spam/ham folders >
> for my users. I know this is generally a nono but in this instance > I
> am willing to run with it given two facts.
> Bayesian filter pollution between users would make it more or less
> useless, though.
> > The first is that spam scanning happens at SMTP. Per user bayes
> > filters do not apply at that time, it has to be global.
I would like to inform you of a project I run that could be helpful in your
situation. There exists a Weighted Private Block List (WPBL) which uses
distributed sightings from statistical/bayesian filters to feed a central
IP blocklist - http://wpbl.pc9.org/
The motivation behind this is that as your statistical filters on existing
accounts detect spam, they inform a central database of the IPs sending the
spam. Consensus of sighting reports from multiple project members results
in a 'block' of that IP address. Sightings of good mail essentially
whitelist IP addresses too!
You can then query that private blocklist from your mail server by querying
a DNSBL (DNS-based blocklist), a standard feature in any MTA. This will
allow you to reject a portion of the spam you receive directly at the mail
server and save later processing 'costs'.
This won't, of course, catch the majority of your spam but it can help you
reject persistent spammers' IPs quite reliably at SMTP time. On my server
this stops about 20% of all spam I receive immediately.