> Frankly, I thought that since we are not ISP, our servers will
> never be compromised.
A lot of people think that, until they get hit. What many spammers do is once a mail
server stops accepting their spam, they just take the next E-mail address on the list,
and try the mail servers for that domain. So if anyone on your system receives any
spam, there's a good chance a spammer will find you some day.
> At this moment I am running antispam relay that is a part of
> Webshield SMTP antiviris. However, I would prefer to simply
> filter the spam before it hits Webshield.
I'm assuming that you are talking about outgoing spam (relaying), not incoming spam.
The spammer has chosen which IP address and port they are going to send to. So, if
you wanted IMail/Declude to deal with the spam, you would need to have IMail/Declude
"in front of" WebShield. But, if you do that, mail will come directly to IMail and
stay there, so WebShield would be out of the picture.
> Is it possible to incorporate Declude antispam into this chain,
> and if yes, what whould be the best setup in terms of resource
> usage and protection for mail server?
Since you have WebShield already, and you seem to have it set up with some anti-spam
ability, I would ask what you are trying to accomplish with Declude.
As far as relaying goes, the best option is to have your server locked down, so that
it only allows relaying for people coming from trusted IP addresses and/or using SMTP
AUTH.
Declude JunkMail Pro will allow you to run its spam tests against outgoing E-mail, and
let you block E-mail that fails the various tests. However, if a spammer is coming
from a "clean" IP address, there is a good chance that they could still send lots of
E-mail through your server.
We are working on a "hijack detector" which will allow you to run an open relay
(almost) safely, by restricting the number of E-mails that can be sent in a given
timeframe. However, it will probably be at least a month before that goes into beta.
The current version will let you see the IP addresses that are relaying, and how many
E-mails have been relayed, which can help you detect the attacks, but the current
version doesn't take action on them yet.
Of course, if you are talking about incoming spam, that's a different story, and
Declude would be able to catch a lot of it, although it couldn't be placed in front of
WebShield (without purchasing an extra copy of IMail as well). We're also working on
a header analysis test that should catch about 80%-90% of spam with very few false
positives.
--
-Scott
Declude: Anti-virus and Anti-spam solutions for IMail. http://www.declude.com
--
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
