In an attempt to contol the amount of spam email which is delivered to our individual mailboxes, Franklin & Marshall College uses a spam firewall. This firewall is a piece of network equipment which filters email delivered from off-campus. We fondly refer to this box as Spammy.
We receive many questions from the college community regarding spam, and here are answers to some of those questions.
When we introduced Spammy to our network, the average number of emails arriving daily from off-campus was 26,048. Over the last two years, that number has increased - 10 fold. More on the numbers after an explanation of how the filters work.
We believe the sheer volume of email processing through our mail system is an indication of the need for filtering, especially given known spammers and the proliferation of malicious and junk email containing viruses. Additionally, our feeling is that the campus community does not really want to receive bogus offers to purchase pharmaceuticals overseas and is definitely not interested in sharing bank account information with some foreign diplomat.
The filtering process occurs through several methods simultaneously.
- Known Spam Sources:
We subscribe to documented lists of known spammers, and Spammy is automatically updated hourly. Mail from these sources is automatically blocked from being distributed on our campus. - Rate Control:
Since spam usually is sent out in quick bursts, any site sending more than 50 messages within 30 minutes is blocked, excluding mail from list servers. - Content:
Using a complicated Bayesian spam filtering system, Spammy looks at the contents of hundreds of emails (no human eyes are involved), both email that is known to be spam and that is known to be valid. Based on known combinations of words, and a Spam index, some email is tagged as suspicious spam. Up until now, the tagged [SPAM:] email has been delivered to your mailbox. If you are interested in finding out more about Bayesian spam filtering, we suggest you start with Wikipedia.
On a single day - January 31, 2007 - Spammy filtered a total of 252,823 email messages received from off-campus. All of the messages fell into one of four categories. The percentages indicate the amount for that category in which Spammy classified the mail.
- 78% Blocked Spam - not delivered to our mailboxes
- 2% Blocked Virus - not delivered to our mailboxes
- 7% Tagged Spam - [SPAM:] mail delivered to our mailboxes
- 13% Clean and Allowed - delivered to our mailboxes
The following chart graphically demonstrates the magnitude of the spam problem at Franklin & Marshall.
Now, instead of delivering the tagged [SPAM:] email to your mailbox, Spammy is going to quarantine and store all of those messages. A message is quarantined when it is considered likely (but not positively) to be spam. Then, on a daily basis, if you have any quarantined email, Spammy will send you a Spam Quarantine Summary report via email. The message lists each quarantined email and includes the time received, from, subject, and some actions you can choose to take. You can also choose to ignore the report and simply delete the report message.
Spammy stores quarantined messages for 30 days. In your daily report, you can click on any one of the following links:
- Deliver - to have the specific email delivered to your mailbox
- Whitelist - to have the specific email delivered to your mailbox, and to have the sender of the message placed on your whitelist so that their messages to you will no longer be quarantined.
- Delete - to have the message deleted from your quarantine
- Click here link to view your entire quarantine inbox or manage your preferences.
One advantage of Bayesian spam filtering is that it can be trained on a per-user basis. That is what the whitelist option can do for you - it enables you to define specific addresses for Spammy to always allow delivery to your mailbox.
More information regarding the Spam Quarantine Summary is available here.
Written by Teresa Hagan