Filtering unwanted mail.
WHAT TECHNIQUES EXIST
Connection-level checks: reputation, reverse names, invalid identification
Rate limiting
Greylisting: deferring unknown senders
Authentication checks Content analysis Reputation services Machine learning classification
WHAT CONNECTION-LEVEL REJECTION PROVIDES
Rejecting before the message is accepted, which costs almost nothing.
WHY THAT IS THE MOST EFFICIENT LAYER
The majority of unwanted mail can be rejected there.
WHAT GREYLISTING EXPLOITS
That much unwanted mail never retries.
WHAT IT COSTS
Delay on first mail from an unknown sender.
WHAT CONTENT ANALYSIS DOES
Scores messages against rules and learned patterns.
WHAT TO CONFIGURE
A threshold for rejection, and a lower one for marking.
WHAT FALSE POSITIVES COST
Far more than false negatives.
WHY
A missed spam message is an annoyance; a rejected invoice is a business problem.
WHAT THAT ARGUES FOR
Conservative thresholds, with quarantine rather than deletion.
WHAT TO PROVIDE USERS
Visibility of what was filtered, and a way to release it.
WHAT TO MONITOR
Rejection rates, and complaints about missing mail.
