The great spam-off, part 4: more SurfControl

So, SurfControl has been in place for the last five days. It has a fairly sophisticated set of tools, but with a much more approachable interface than Praetor. I’ve been using three rules: one screens out malformed MIME messages, one blocks messages with high dictionary scores (according to the spam dictionary that ships with the product), and one blocks messages that are on the collaborative filtering list that SurfControl maintains.
So far, the combination is working reasonably. There are still too many uncaught spams slipping through, largely of the variety that consist only of images (I added a rule for “Please wait while this email loads”; I bet that’ll catch a bunch of them). More troubling is the rules service’s tendency to abruptly stop processing inbound messages– so far, I’ve gotten three or four messages from Microsoft that have choked the rules service. I have a call in to SurfControl tech support, so we’ll see how competent they are at diagnosing and fixing the problem.
Update: the problem that caused MailMarshal SurfControl to choke on inbound messages was quickly identified. They fixed it in a patch, and their tech support was very helpful in answering some questions I had about the way the product worked. (Originally I’d typed “MailMarshal” in the above; to clarify, I haven’t had to call MailMarshal support so far.)