Paul's Down-Home Page

So, SurfControl has been in place for the last five days. It has a fairly sophisticated set of tools, but with a much more approachable interface than Praetor. I’ve been using three rules: one screens out malformed MIME messages, one blocks messages with high dictionary scores (according to the spam dictionary that ships with the product), and one blocks messages that are on the collaborative filtering list that SurfControl maintains.
So far, the combination is working reasonably. There are still too many uncaught spams slipping through, largely of the variety that consist only of images (I added a rule for “Please wait while this email loads”; I bet that’ll catch a bunch of them). More troubling is the rules service’s tendency to abruptly stop processing inbound messages– so far, I’ve gotten three or four messages from Microsoft that have choked the rules service. I have a call in to SurfControl tech support, so we’ll see how competent they are at diagnosing and fixing the problem.
Update: the problem that caused MailMarshal SurfControl to choke on inbound messages was quickly identified. They fixed it in a patch, and their tech support was very helpful in answering some questions I had about the way the product worked. (Originally I’d typed “MailMarshal” in the above; to clarify, I haven’t had to call MailMarshal support so far.)

SurfControl finally bit the dust; its eval period expired, so I knew it was time to try something else. SurfControl is a decent product; my big complaint was that its “Anti-Spam Agent” (a collaborative filtering tool that requires you to download updates from SurfControl) wasn’t catching much. Turns out that was due to SurfControl’s failure to allow eval customers to get the updates.
As I type this, MailMarshal SMTP is installing. It has a good reputation, so I’m eager to see how it stacks up against the others I’ve been testing. In the meantime, I have inbound SMTP queueing up for filtering, so MailMarshal should have a fertile set of messages to start with.
Update: Wow. MailMarshal has caught something like 99.2% of the inbound spam so far. I’m very impressed.
Update again: over a five-day test period, MailMarshal flagged 362 messages as spam. 49 (13.6%) of those were actually legitimate messages, most of which should have been allowed through by the “friendly listserver” and “friendly senders” features. None of these messages were critical, and frankly, many of them should probably be considered as spam. During the same time period, I only got *two* real spams. A number of legitimate messages (including some from our customers at MS and from the ntbugtraq mailing list) were flagged because they triggered the double-extension filter (like “document-1.0.5-pk.doc”) or because they contained JavaScript. I appreciate the protection, but it’s been a bit of a hassle.
I’m impressed with MailMarshal’s efficacy, but its reporting tools don’t seem to be as good as the ones in SurfControl (which tells you at a glance how long it’s been up, how many messages were flagged as spam, and how many passed through.)
Update: Carrie Ward of NetIQ was kind enough to send me pricing info on MailMarshal:

NetIQ MailMarshal 5.5 SMTP is priced by the number of users in an organization and is available as a small business server license for up to
75 users for $1,295 or as an Enterprise version including a four-server license for $2,000 plus $750 per 100 users.

Here’s an interesting article: Foundstone is accused of piracy, being buttheads, and probably mopery on the high seas. Interestingly, the article also claims that Microsoft dropped Foundstone as a vendor shortly after the problems came to light.