Rival solutions smack down spam

See correction at end of review

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

Spam is such a significant problem these days that even the federal government has gotten involved, passing legislation such as the CAN-SPAM Act. Meanwhile, a wide variety of companies has collaborated on an authentication scheme called the Sender ID Framework, aimed at making e-mail fraud even harder to perpetrate. Realistically, though, neither CAN-SPAM nor e-mail-sender authentication is likely to do much to stem the flood of mail. Fortunately, anti-spam products continue to evolve and improve.

In my ongoing tests of anti-spam products, I recently looked at four more contenders: Brightmail Anti-Spam 6.0 from Symantec; IMSS (InterScan Messaging Security Suite) Version 5.5 from Trend Micro; MailFrontier Enterprise Gateway 3.1 from MailFrontier; and PureMessage 4.6 from Sophos. They all performed admirably, filtering more than 90 percent of spam, with few false positives.

All are software gateways that can reside on the same system as your mail server or on a separate system. They all offer enterprise-caliber features, including user access to quarantined messages; automatic setup of user access to quarantined messages; different policies by user, group, or domain; optional anti-virus scanning; and useful reporting tools. Pricing for all four is within $1 per user, per year, for anti-spam, anti-virus, and policy filtering.

Beyond the basics, Brightmail offers a simple installation with almost no configuration or tuning required, and little ongoing maintenance is necessary. Trend Micro delivers extensive tuning capabilities that cater to the needs of varying groups of users. MailFrontier provides easy installation and great reporting. Sophos installs on Linux only, and it provides a great deal of flexibility as well as a relatively simple installation.

As for accuracy, Brightmail sets the standard for filtering performance, boasting zero false positives, critical or bulk, and stopping 97.69 percent of spam. With zero critical false positives, 1.26 percent bulk false positives, and 96 percent of spam stopped, Sophos will also keep end-users content. MailFrontier is also quite acceptable, with the spam-stopping score of 97.95 percent, three critical false positives out of 1,711 messages, and a bulk false positive rate of 0.94 percent. IMSS is still well within the acceptable range, with a bulk false positive rate of 0.6 percent, one critical false positive out of 834 messages, and 96.5 percent of spam blocked.

The importance of the false positives rate should not be overlooked; that statistic is arguably more significant than a solution’s spam-blocking percentage. Mining the quarantine for false positives, after all, is much more time-consuming than dealing with the few spam messages that slip through the filter.

In my tests, I divided the false positives into two categories: bulk and critical. Stopping some bulk e-mails, such as newsletters, mailing lists, and authorized marketing e-mails from getting through is not the worst thing in the world, and it’s generally easily remedied by adding a few senders to the whitelist. Critical false positives are personal e-mails addressed to specific users that get blocked. A high critical false positive rate is the biggest barrier for end-user acceptance of anti-spam filters: If it’s too high, they stop trusting the filter or have to spend a lot of time checking quarantined e-mail every day.

Symantec Brightmail Anti-Spam 6.0

Brightmail Anti-Spam 6.0 is the latest in a line of products that has been a top performer in our tests during the past couple of years. Recently acquired by Symantec, Brightmail will offer few surprises to those familiar with previous versions.

The solution installs easily on Windows 2000 and 2003 Servers. It does require IIS for SMTP services and will prompt you to install it if it’s not present. It would be nice if it also warned you that using the default installation option for IIS through Windows doesn’t install the needed SMTP component. It also installs MySQL Pro and the open source Tomcat application server, which handles quarantined messages and grants end-users access to the quarantine. A license key is also required, as is registration through the Symantec Web site.

Configuration is simple, straightforward, and well-documented. When the initial configuration is complete, there is little else to do. There are controls for the filters available, but given the very high performance of the filters in the default position, it’s hard to imagine anyone wanting to mess with them. Further, there are no updates to schedule, as they occur automatically.

Brightmail provides Web access to the quarantine on a per-user basis. Users may also access the quarantine via plug-ins for Microsoft Outlook and Exchange as well as for Lotus Domino. Users may view quarantined messages, release messages incorrectly identified as spam, report spam that got through, and control their whitelist and blacklist settings. User and group information can be imported from Active Directory or other LDAP directories to speed the setup process.

Administration is also performed via browser, and admins can manage multiple servers across the enterprise from a single console. Policies are manageable by domain, group, or users, with fine granularity for controls as well as permissions for end-user access.