[Mimedefang] implementing a small-scale spam filtering and recovery system

[David F. Skoll]

On Mon, 26 Aug 2002, Tony Nugent wrote:

> My idea (untested) goes like this... go ahead and divert spam into a
> "spammer" account so that the original person does not see it.

> On one or more (or every?) client, set up a second imap account
> which gives them access to all the spammer email where they may
> delete or recover messages.  (Trust and confidentality is assumed
> within the office).

The big difficulty comes when a message for more than one recipient is
diverted.  The first recipient to grab it out of the IMAP or POP3
store gets it; the second doesn't (well, for POP3, anyway.)  You can
work around this by re-mailing the message to individual recipients'
spam accounts and then discarding the original message.  You may also
waste time because now everyone can see everyone's spam, not just
his own. :-)

> How are others managing spam?  (CanIt seems to be very cool, using a
> white/blacklist databases and so on...)

CanIt uses a database to store (part) of the message, and tempfails it
until the message is released.  I'm working on a much more
sophisticated version of CanIt called CanIt-ISP which lets ISP's
delegate spam-control responsibility to end-users.  An "end-user" can
be defined as a single person, a spam-control officer for a
virtually-hosted domain, a person who takes care of a department, etc.
Each end-user can have his or her own blacklists, whitelists, auto-reject
thresholds, real-time blacklist subscriptions, etc...

Messages for multiple recipients are still a headache, and CanIt-ISP
falls back to storing and remailing messages in that case.  You cannot
tempfail a message for one recipient, but not another, after the DATA
phase. :-(

--
David.