Enterprise spam filtering software?

[cross6]

We use GFI, but it SUCKS - anyone know any other good ones?

 

[iamwiz82]

We use SurfControl here. Good stuff.

 

[Syrch]

we use websense and iron mail

 

[Rudee]

I don't run anything other then Microsoft pop-up blocker and Microsoft anti-spyware.

 

[LeiZaK]

GFI

 

[RagingBITCH]

Enterprise spam filtering. Not personal pop up blocker.

And at my old company, used to use Symantec Enterprise

 

[SagaLore]

Get a gateway appliance. The Solinus MailFoundry works very well.

PM me if you want other solutions (that I have tested).

 

[SagaLore]

Originally posted by: Syrch
we use websense and iron mail

Do you just use the base software, or are you also using the additional modules?

 

[cross6]

Originally posted by: SagaLore
Get a gateway appliance. The Solinus MailFoundry works very well.

PM me if you want other solutions (that I have tested).

I don't know if a gateway will work well with our network setup

 

[SagaLore]

Originally posted by: cross6

Originally posted by: SagaLore
Get a gateway appliance. The Solinus MailFoundry works very well.

PM me if you want other solutions (that I have tested).

I don't know if a gateway will work well with our network setup

You want an enterprise solution, which leads me to believe that you use internal mail server(s), and your emails go through mx record(s) that has to come through a firewall at some perimeter. Right?

 

[cross6]

Originally posted by: SagaLore

Originally posted by: cross6

Originally posted by: SagaLore
Get a gateway appliance. The Solinus MailFoundry works very well.

PM me if you want other solutions (that I have tested).

I don't know if a gateway will work well with our network setup

You want an enterprise solution, which leads me to believe that you use internal mail server(s), and your emails go through mx record(s) that has to come through a firewall at some perimeter. Right?

mx record --> two net connections --> two pix's --> two routers (HSRP group) --> mail server

 

[SagaLore]

Originally posted by: cross6

Originally posted by: SagaLore

You want an enterprise solution, which leads me to believe that you use internal mail server(s), and your emails go through mx record(s) that has to come through a firewall at some perimeter. Right?

mx record --> two net connections --> two pix's --> two routers (HSRP group) --> mail server

You only have 1 mx record and 1 mail server, but redundant connections/hardware in between? Is that correct?

If so, then a gateway appliance is still your best bet. It can sit behind the firewalls and each one will tunnel port 25 on your mx IP to the appliance. Then it will send filtered email to your mail server.

 

[cross6]

Originally posted by: SagaLore

Originally posted by: cross6

Originally posted by: SagaLore

You want an enterprise solution, which leads me to believe that you use internal mail server(s), and your emails go through mx record(s) that has to come through a firewall at some perimeter. Right?

mx record --> two net connections --> two pix's --> two routers (HSRP group) --> mail server

You only have 1 mx record and 1 mail server, but redundant connections/hardware in between? Is that correct?

If so, then a gateway appliance is still your best bet. It can sit behind the firewalls and each one will tunnel port 25 on your mx IP to the appliance. Then it will send filtered email to your mail server.

yeah, but I'll need two right?

money people won't go for that when software costs $300 lol

 

[vi edit]

If you are using an Exchange server, I've been pretty happy with GFI. For the price, ease of use, and reliability of it, it's not bad.

Once you give the Bayesian filter time to learn, it's fairly accurate. What are your complaints with it?

 

[cross6]

Originally posted by: vi_edit
If you are using an Exchange server, I've been pretty happy with GFI. For the price, ease of use, and reliability of it, it's not bad.

Once you give the Bayesian filter time to learn, it's fairly accurate. What are your complaints with it?

Letting through blacklisted emails if they are in HTML format

 

[bsobel]

Originally posted by: cross6
We use GFI, but it SUCKS - anyone know any other good ones?

Brightmail....

 

[SagaLore]

Originally posted by: cross6

Originally posted by: SagaLore

Originally posted by: cross6

Originally posted by: SagaLore

You want an enterprise solution, which leads me to believe that you use internal mail server(s), and your emails go through mx record(s) that has to come through a firewall at some perimeter. Right?

mx record --> two net connections --> two pix's --> two routers (HSRP group) --> mail server

You only have 1 mx record and 1 mail server, but redundant connections/hardware in between? Is that correct?

If so, then a gateway appliance is still your best bet. It can sit behind the firewalls and each one will tunnel port 25 on your mx IP to the appliance. Then it will send filtered email to your mail server.

yeah, but I'll need two right?

money people won't go for that when software costs $300 lol

No, just one.

Originally posted by: cross6

Originally posted by: vi_edit
If you are using an Exchange server, I've been pretty happy with GFI. For the price, ease of use, and reliability of it, it's not bad.

Once you give the Bayesian filter time to learn, it's fairly accurate. What are your complaints with it?

Letting through blacklisted emails if they are in HTML format

That is actually a common problem that many email filters have. They only look at the unencoded text, so my message "OMGHI2U2!!! BUY VIAGARA!", could look like in plaintext (to the filter) as "<html><orange>OM</orange><yellow>GHI2</yellow>&l
;stars>U2!</stars><moon>!! BU</moon><vector>Y VIA</vector><scalar>GARA!</scalar></html>".

It was awhile before I noticed any of the spam filtering solutions catch on. You need an html rendering engine so the filters can see what the person sees.

What dns/ip RBL's are you using now?

Btw, how many people are in your company? $300 doesn't sound right...

 

[cross6]

Originally posted by: SagaLore

Originally posted by: cross6

Originally posted by: SagaLore

Originally posted by: cross6

Originally posted by: SagaLore

You want an enterprise solution, which leads me to believe that you use internal mail server(s), and your emails go through mx record(s) that has to come through a firewall at some perimeter. Right?

mx record --> two net connections --> two pix's --> two routers (HSRP group) --> mail server

You only have 1 mx record and 1 mail server, but redundant connections/hardware in between? Is that correct?

If so, then a gateway appliance is still your best bet. It can sit behind the firewalls and each one will tunnel port 25 on your mx IP to the appliance. Then it will send filtered email to your mail server.

yeah, but I'll need two right?

money people won't go for that when software costs $300 lol

No, just one.

Originally posted by: cross6

Originally posted by: vi_edit
If you are using an Exchange server, I've been pretty happy with GFI. For the price, ease of use, and reliability of it, it's not bad.

Once you give the Bayesian filter time to learn, it's fairly accurate. What are your complaints with it?

Letting through blacklisted emails if they are in HTML format

That is actually a common problem that many email filters have. They only look at the unencoded text, so my message "OMGHI2U2!!! BUY VIAGARA!", could look like in plaintext (to the filter) as "<html><orange>OM</orange><yellow>GHI2</yellow>&l
;stars>U2!</stars><moon>!! BU</moon><vector>Y VIA</vector><scalar>GARA!</scalar></html>".

It was awhile before I noticed any of the spam filtering solutions catch on. You need an html rendering engine so the filters can see what the person sees.

What dns/ip RBL's are you using now?

Btw, how many people are in your company? $300 doesn't sound right...

relays.ordb.org

sbl.spamhaus.org

 

[SagaLore]

Try out these blacklists.

I need to update that article because there are a few more I have found that work really well...

 

[iamwiz82]

The number one blacklist for my filter in terms of blocks per day is sbl-xbl.spamhaus.org, followed by bl.spamcop.net. The other 7 I have configured rarely get anything that these two don't get first.

EDIT: HA! That's what Saglore's article said to use

 

[Cable God]

GFI on Exchange '03. Works great and is pretty accurate.