Spam

[Robert Dinse <nanook@eskimo.com>]

     I have received so many comments from both sides, those that want the spam
filters and those that don't that I can not address them all individually.

     Since I continue to receive a large number of complaints about spam,
and the level of spam is seriously interferring with my own ability to use
and process legitimate mail, I am going to continue to look for a
solution.

     It is my belief that no workable solution can exclude denying mail
from open relays.  Easily 95% of the spam I receive is relayed in this
manner because it both allows the spammer to avoid direct filters and it
allows them to multiply their bandwidth effectively by stealing the
bandwidth of the intermediate site.  They upload one letter with 100, 200,
or 1000 "rcpt to:"'s, and they've just multiplied their effective
bandwidth by 100, 200, or 1000 times.  No legitimate mail is relayed in
this manner, but unfortunately some legitimate e-mail does come through
these misconfigured servers. 

     The most effecient solution is to do this up front, before the server
even connects but a significant number of business customers indicated it
was not acceptable to them to lose any legitimate e-mail.  There is no
method of spam filtering that will not discard some legitimate mail coming
from misconfigured servers. 

     Filtering on a per user basis on the back-end could be done but it
would be extremely ineffecient, given the volumes of spam, so much so that
it would overwhelm existing mail processing facilities and already four
machines are processing mail.  Another problem with back-end filtering is
that it does not readily afford the opportunity to inform the site with
the misconfigured server of that fact.

     Right now we use addresses under eskimo.com for mail, but we also own
the eskimo.net domain.  I am considering setting up a seperate mail
subsystem for eskimo.net that is heavily spam filtered, that is where we
not only discard mail from open relays but also mail from sites with
improper DNS, mail that has recipients that don't match legitimate address
to users here, mail that originates on dynamic IP dial-ups, and then
giving people an option of having an address under either domain according
to whether they just want legitimate mail with a small risk of losing an
occasional piece of mail from an improperly secured server, or if they'd
rather wallow in spam without that risk. 

     Unless I can figure out a way to make sendmail bind to only a single
IP so I could impliment this as a virtual domain, it will probably be
necessary to invest in additional hardware, and if that is the case, I
will need to charge for this service to recover the costs.