Overview
This article will give you an overview of what are spam filters, the different kinds of filters and how they work.
Contents
What are spam filters?
A spam filter is a program that is used to detect unsolicited and unwanted email and prevent those messages from getting to a user's inbox. A spam filter uses prebuilt rules to assess whether or not the incoming emails are spam or pose a security threat. Some filters are designed to prevent the emails from ever reaching the recipient, other filters such as the Gmail filter are used to categorise emails into inbox, promotions and updates. Spam filters drastically reduce the load on server resources, considering that 85 percent of all mail sent globally is spam.
The different types of filters
Gateway spam filters are physical servers that are installed at the border of a company’s network, and serve as a mailbox provider’s first line of defense in preventing spam. All mail attempting to come into the company must pass through this “gate” before it can enter the system. This spam filter learns what to deem as spam based on all the email coming into the company, which means it has less email data to learn from than a hosted spam filter (discussed below). Examples of gateway spam filters include Cisco’s IronPort and Barracuda.
Third party (or hosted) spam filters are companies that have developed their own way of using content and reputation metrics to distinguish spam from legitimate mail. Third party spam filters can influence filtering decisions at the gateway or after a message is accepted through the gateway (i.e., spam or inbox placement). Since these spam filters have a large book of clients using their service, they have a broad scope of information to use in determining whether to deliver to the inbox, spam, quarantine folder, or block the message completely. Examples of third party spam filters include Cloudmark, MessageLabs and Mimecast.
Desktop spam filters are a version of third party spam filters that live on the end user’s computer. They are highly customizable by the individual, so they can be among the more difficult filters to pass through. An example of a desktop spam filter is Outlook, which uses Microsoft’s anti-spam filter SmartScreen to help filter email. SmartScreen uses the feedback from Windows Live Hotmail users to help distinguish legitimate emails from spam.
How do spam filters work?
Sometimes your emails have to pass through all three types of filters before they reach the end recipient. Each type of filter will have their own set of rules, algorithms, heuristics, and the more advanced form of heuristics known as Bayesian as part of their filtering technology.
Mailbox providers typically use four main areas to asses filtering decisions:
- The source of the mail
- The reputation of the sender
- The content of the mail they send
- Subscriber engagement
Source
Filters look at the sender's authentication, frequency of sending, how long the IP has been used and the overall volumes during that time. Spammers frequently change IPs so that they can't be tracked. Because of this filters treat any new IPs with caution. The longer an IP and domain is in use, leads to a stronger reputation.
Reputation
There are millions of different data points and parameters that are used to calculate reputation. Based on the overall sending score from these algorithms, creates a threat assessment on all inbound emails. Some of the high level factors that are used are:
Content
Filters will scan the content of the inbound emails including the HTML, copy, images, URLs and subject lines. Not every filter will check every part of the content.
Engagement
Some filters also look at historical engagement of the users to assess whether or not to allow emails through. If recipients engage (i.e. open or click) with the emails, then it is far more likely that the emails are not spam. This also allows the filter to not only gauge whether the email is spam, but also whether the email is actually wanted by their users. This means that you as a sender should also be considering whether your content is relevant and engaging. It's really important to assess your data quality and not send to contacts who are not interested in your content.
Useful Links
