Re: Spam filtering at SMTP-time

[forum@users.pc9.org]

> > I'm loking for shared folders so I can offer global spam/ham folders >
> for my users.  I know this is generally a nono but in this instance > I
> am willing to run with it given two facts.
> 
> Bayesian filter pollution between users would make it more or less
> useless, though.
> 
> > The first is that spam scanning happens at SMTP.  Per user bayes
> > filters do not apply at that time, it has to be global.

I would like to inform you of a project I run that could be helpful in your 
situation. There exists a Weighted Private Block List (WPBL) which uses 
distributed sightings from statistical/bayesian filters to feed a central 
IP blocklist - http://wpbl.pc9.org/

The motivation behind this is that as your statistical filters on existing 
accounts detect spam, they inform a central database of the IPs sending the 
spam. Consensus of sighting reports from multiple project members results 
in a 'block' of that IP address. Sightings of good mail essentially 
whitelist IP addresses too!

You can then query that private blocklist from your mail server by querying 
a DNSBL (DNS-based blocklist), a standard feature in any MTA. This will 
allow you to reject a portion of the spam you receive directly at the mail 
server and save later processing 'costs'.

This won't, of course, catch the majority of your spam but it can help you 
reject persistent spammers' IPs quite reliably at SMTP time. On my server 
this stops about 20% of all spam I receive immediately.

-- 
forum@users.pc9.org