What is SpamOnion?

SpamOnion is an Unsolicited Commercial Email (UCE), or spam, filtering service. That is, it is a service designed to reduce the amount of spam that reaches the customer's mailbox. As you have probably guessed, combating spam is not easy and there is no silver bullet to do so. The main concept of the SpamOnion service is to use a layered approach to detecting spam. Not one test, but 10 or more layers can be run on each incoming message to help determine if it a spam message or not. Indeed, there are many spam filtering products on the market today, but SpamOnion is one of the few that utilize a layered defense. This is a big advantage in today's Internet.

Fighting spam is like an arms race. As email administrators find ways to block a certain type of spam, the spammers develop new ways to get around those blocks and still infiltrate the user's mailbox. A layered anti-spam tool is much less likely to be defeated by the latest spammer tricks. This is because there are several checks being made and odds are one or more of the layers will flag the offending message as spam. But just as importantly, SpamOnion is a service. SaNE technicians are constantly on the lookout for the latest anti-spam tools and tricks. This information comes from the whole Internet anti-spam community where thousands of email administrators discuss the methods that work for them. SaNE examines these methods, decides if they are benefit to our customers and implements them as improvements to SpamOnion if there are benefits. In return, SaNE is active in the anti-spam community and returns the favor by providing our own methods that have proved effective.

SpamOnion is configurable on both the domain level and the user level. In this context domain level refers to spam filtering layers that are run on all email messages for a domain. Most of these layers are run while a message is attempting to be delivered via SMTP (Simple Mail Transport Protocol). Some example layers are:

• Making sure the sending server is following the SMTP protocol correctly.

• Making sure the sender address really exists.

• Checking to see if the sending server is on any of the Real Time Blacklists.

• Searching attachments for virus, worms or other malignant software (aka malware).

The administrator of the domain can turn on or off any of the domain level layers. There are also domain-wide whitelists and blacklists. Blacklists allow the domain administrator to reject messages from a particular sender email address, sender domain or sender IP address immediately. Whitelists allow the domain administrator to keep a layer turned on, but allow one or more friendly sender email addresses, sender domains or sender IPs to be automatically accepted.

The last layer of SpamOnion utilizes a piece of software known as DSPAM. This is a user level layer. If a message makes it through all of the previous layers, it is passed to DSPAM. If a message is classified as spam by DSPAM, it is placed in a quarantine box. The user is able to access the quarantine box via a web based interface (e.g. Internet Explorer, Mozilla Firefox) where he/she can delete actual spam messages. If DSPAM made a mistake, say classified a message as spam when it is not, the user can have DSPAM learn from its mistake. Or if DSPAM let a spam message get through, the user can correct DSPAM either via the web interface or by forwarding the spam message to a particular email address. In short, DSPAM learns the user's email behavior and tunes itself to be a very effective filter for that user.

Because the domain level layers and the user level layers are configurable, the customer can tune SpamOnion to reflect their own, unique needs. Think of it as a sliding scale where no two organizations will necessarily have the same settings. At one end of the scale, the customer could decide to have all of the SpamOnion layers running. This would stop the most amount of spam and potentially provide the greatest time savings for the end users; but the risk of a false positive (a real message being classified as spam by mistake) is low to medium. At the other end of the scale, the customer could turn off most or all of the domain level layers and only utilize the user level layer (DSPAM) Therefore all messages will eventually tune DSPAM to that individual's email patterns. The disadvantage is slightly more time must be used by the end-user until the filters are tuned to their email behavior patterns. Most organizations will fit somewhere in between.

To utilize SpamOnion, the customer must only run their own mailserver or have an existing email service for their domain and have the ability to request a change for their domain DNS MX record settings. The customer's mail server or mail service can exist almost any where and SpamOnion will continue to work. No software needs to be installed on the customer's mail server or the end user's desktop/laptop. SaNE will constantly update SpamOnion to fight the latest spammer threat. The customer only need sit back and get less spam in their mailbox; and be more productive because of it.

Please review our latest SpamOnion documentation for a more detailed description of how SpamOnion works, a list of requirements, pricing and customer documentation.