How do Spam Filters work - March 13, 2008
Filters make mistakes -- here's how to make sure your legitimate email gets through.
These days, spam filters on personal computers and corporate networks are absolutely necessary. This software is designed to snare presumably unwanted incoming messages based on a variety of characteristics, including the sender's email address, words in the message subject line or even in the body of the message.
Most of the time, spam filters work. Of the 1,409 million inbound emails scanned by Barracuda Networks Anti-Spam , in December, 1.250 million were intercepted as spam. That's a global spam ratio of one in every 1.3 emails.
Yet, spam filters are not perfect. Sometimes, they snare perfectly legitimate messages, such as a "cold call' email a sales executive might send to a potential client, or even a message from a potential customer to a corporation's vice president of purchasing.
"The problem [of spam filters catching legitimate email] is getting worse, because companies are angry with the amount of email that is being sent to them," says Adam Sarner, customer relationship management analyst with Gartner, Inc., Stamford, Ct. "As a result, enterprises tend to block [messages] first and ask questions later. Spam is that bad that businesses and consumers are much more willing than they used to, to pass up a [legitimate] email or two rather than letting it all through."
Sarner likens spam filters turned to maximum protection mode to a car alarm turned too high -- and set to go off even when an innocent pedestrian walks in the general vicinity of the vehicle.
When a spam filter working within an email program sees a suspicious incoming message, the filter will either delete the message entirely, or place it in a special spam folder the recipient is free to browse if and when he is so inclined.
The occurrences of legitimate email being grabbed by spam filters is so acute, the phenomenon has a name: false positives. In a common false positive scenario, a legitimate business email could wind up in a user's voluminous spam file, 65th in a list of 217 solicitations for everything from bargain real estate to body enhancement potions.
And, if your perfectly sincere message is surrounded by such unseemly entreaties, it will probably never get read.
"False positives are definitely a problem," says John Levine, author of "Fighting Spam For Dummies." He's also a spam expert who has testified in front of U.S. Senate and Federal Trade Commission committees studying the issue of unwanted commercial email.
Unfortunately, spam filters seem to have an anxiety attack when they encounter legitimate emails dressed up with pretty graphics. Since porn, free travel and other spammers like to use graphics, you, as a legitimate marketer, suffer at least some guilt by association.
"Spam filters tend to work with formatting rather than words," says Brian McCarthy, Security Expert and CEO of Sencilo Solutions of Miami Florida. "Some companies attempt to pre-format their emails in HTML with a logo and letterhead. The more you have of it, the more it brings alarm bells," and creates false positives.
Tony Skoll, a email filtering customer of Barracuda Networks, believes an enterprise can minimize or even eliminate the problem of false positives by implementing a server-based filtering solution that leaves the final decision about what is or is not spam up to each end-user. "People are getting fed up with the hack-and-slash approach toward [spam management]," he says. "Server-based solutions learn over time what is considered spam and what is not, and can be tailored and configured down to the user level."
Daniel Tynan, author of "Privacy Annoyances," and a regular columnist for Sales and Marketing Management magazine, sees both sides of the issue. "It is possible to tune spam filters to get false positives down, but the typical overworked network administrator too often says that 'we are getting so much pornography,'" that the spam filter remains turned on to maximum strength, Tynan says.
So what can a legitimate emailer to do to avoid being caught in the spam trap? Experts offer several suggestions:
If you are sending a message to someone you don't know, consider sending the email as plain text, rather than as HTML, which makes the message look like a Web page. Tynan recommends plain text because spammers often use HTML computer code to hide "beacons." These are small graphics that when a user opens up a spam, sends a type of "message opened" acknowledgement back to the sender.
Don't send attachments if the recipient does not know you. Levine, who is also a board member of the Coalition Against Unsolicited Commercial Email, says that because many spammers and virus writers use attachments to spread pornography and malicious computer code, spam filters and anti-virus software sometimes view attachments with suspicion.
In your message subject line, be as specific as possible. This point is especially relevant because spammers have gotten smart enough to write messages with perfectly plausible scenarios, such as "Conference call tomorrow at 10 a.m." "That being the case, don't send a generically titled message, but give as many straightforward details as you can in the subject line," says Levine, who suggests naming specific conference call participants or departments. In other words, instead of typing "Conference call tomorrow at 10 a.m." in your message subject line, Levine suggests trying something such as "Conference call with audit committee tomorrow at 10 a.m." Given the specifics of that subject line, spam filters would recognize the message is not generic, and would probably let it through to the recipient's inbox.
Even if your message is legit, stay away from message subject words that spam filters look for. Although these words vary with each anti-spam software product, a typical list of such terms is available from free anti-spam utility SpamAssassin. A few suspect terms to avoid include: "for only" and "hello," subject lines that start with dollar signs, and words like "free" or "guaranteed" spelled with all capital letters. See the sidebar for a more comprehensive list of these terms.
Obtain permission first. "Email works best when there is full agreement between the sender and receiver," says Gartner analyst Sarner. In some cases, permission would entail contacting the recipient, advising her that you will be sending her an email, and then asking that she adjust her spam filter to ensure that the utility she uses lets your message in. Of course, seeking permission to email a company changes the nature of the email from a cold call to something that is expected. That is fine with Sarner, who views the false positive risks as so acute that sending unexpected email without notifying the recipient first can be a waste of time. Otherwise, "these [unsolicited messages] are going to be reported as spam, blocked and then ignored," says Sarner. "You will want to rise above that noise level, and the best way to do it is to start out with a telephone call or even a face-to-face meeting."
Because the cost-benefit balance between too much spam and that occasional missed potential customer is elusive, the wisest policy is, unfortunately, sometimes a case of the lesser of two evils.
"Fundamentally, it stinks to have to make Draconian tradeoffs, but if you are a business, you have to put up with it," says Levine.
For more information please call (407) 265-6293 or visit us at: http://www.sencilo.com/products-security.php
About Us
Sencilo Solutions is a Florida-based integrator specializing in storage, security and networking solutions. Sencilo delivers a comprehensive portfolio of products from best-of-breed hardware and software from multiple manufacturers including VMware, EMC, NetApp, Juniper Networks, Hitachi, Symantec, Barracuda Networks, and HP. Its technical expertise is known throughout the storage and security industry. Clients include leading corporations, major financial institutions, top universities, government facilities, as well as small to medium size businesses. Sencilo's professional services include consulting, integration, project management, installation, maintenance and knowledge transfer.
Sencilo has offices throughout Florida including: Jacksonville, Miami, Tampa, St. Petersburg, Orlando, Hialeah, Fort Lauderdale, Tallahassee, Cape Coral, and Pembroke Pines.
Key words: Barracuda Networks Security RSA Encryption Cisco Decru Neoscale EMC NetApp HP IBM Quantum Compliance VTL Data Domain vs Gartner Magic Quadrant SSL SonicWall Secure Computing Firewall VPN Endpoint
