Rival solutions smack down spam

See correction at end of review

Spam is such a significant problem these days that even the federal government has gotten involved, passing legislation such as the CAN-SPAM Act. Meanwhile, a wide variety of companies has collaborated on an authentication scheme called the Sender ID Framework, aimed at making e-mail fraud even harder to perpetrate. Realistically, though, neither CAN-SPAM nor e-mail-sender authentication is likely to do much to stem the flood of mail. Fortunately, anti-spam products continue to evolve and improve.

In my ongoing tests of anti-spam products, I recently looked at four more contenders: Brightmail Anti-Spam 6.0 from Symantec; IMSS (InterScan Messaging Security Suite) Version 5.5 from Trend Micro; MailFrontier Enterprise Gateway 3.1 from MailFrontier; and PureMessage 4.6 from Sophos. They all performed admirably, filtering more than 90 percent of spam, with few false positives.

All are software gateways that can reside on the same system as your mail server or on a separate system. They all offer enterprise-caliber features, including user access to quarantined messages; automatic setup of user access to quarantined messages; different policies by user, group, or domain; optional anti-virus scanning; and useful reporting tools. Pricing for all four is within $1 per user, per year, for anti-spam, anti-virus, and policy filtering.

Beyond the basics, Brightmail offers a simple installation with almost no configuration or tuning required, and little ongoing maintenance is necessary. Trend Micro delivers extensive tuning capabilities that cater to the needs of varying groups of users. MailFrontier provides easy installation and great reporting. Sophos installs on Linux only, and it provides a great deal of flexibility as well as a relatively simple installation.

As for accuracy, Brightmail sets the standard for filtering performance, boasting zero false positives, critical or bulk, and stopping 97.69 percent of spam. With zero critical false positives, 1.26 percent bulk false positives, and 96 percent of spam stopped, Sophos will also keep end-users content. MailFrontier is also quite acceptable, with the spam-stopping score of 97.95 percent, three critical false positives out of 1,711 messages, and a bulk false positive rate of 0.94 percent. IMSS is still well within the acceptable range, with a bulk false positive rate of 0.6 percent, one critical false positive out of 834 messages, and 96.5 percent of spam blocked.

The importance of the false positives rate should not be overlooked; that statistic is arguably more significant than a solution’s spam-blocking percentage. Mining the quarantine for false positives, after all, is much more time-consuming than dealing with the few spam messages that slip through the filter.

In my tests, I divided the false positives into two categories: bulk and critical. Stopping some bulk e-mails, such as newsletters, mailing lists, and authorized marketing e-mails from getting through is not the worst thing in the world, and it’s generally easily remedied by adding a few senders to the whitelist. Critical false positives are personal e-mails addressed to specific users that get blocked. A high critical false positive rate is the biggest barrier for end-user acceptance of anti-spam filters: If it’s too high, they stop trusting the filter or have to spend a lot of time checking quarantined e-mail every day.