One of my favourite things about the new Ironport platform we have implemented to combat spam on our networks is how it uses a reputation based system to determine how to handle incoming mail.
Right at the point of connection, before any of the SMTP commands are sent, our Ironport boxes look up the Sender Base Reputation Score (SBRS) of that IP address, and if it’s really bad, the connection is simply dropped. This on it’s own is pretty great, but there’s more. All the time our Ironport boxes are gathering information about the hosts who are sending email through them, and reporting back to the master SenderBase database. This isn’t just true for our Ironport platform, the vast majority of other Ironport users (over 100,000 organisations) also report their statistics back to the senderbase database too.
Because of this updating from everyone all the time, spam outbreaks from new hosts can be caught really quickly, and we will start blocking them almost immediately. As the host is blocked at the connection level, this takes very little resources on the box, especially compared to the full-on scanning that would be done if the message was not blocked. As I’m writing this, our email systems are blocking over 97% of all messages as a result of their bad reputation, which is over 75 million messages! Imagine how much more spam we’d all have in our mailboxes without this. It really is a sorry reflection of email today that less than 1% of email that has hit the platform so far today have been considered “clean”.
Finally, another great thing about senderbase is it’s transparency. Anyone can look up their IP on the site, http://www.senderbase.org, and look at the current top hitters for spam, virus and just normal email traffic. They even have a map on there that shows you where all the mail is coming from.
This entry was posted by Ben Brown on Tuesday, January 13th, 2009 at 4:08 pm and is tagged with Email, Ironport, Spam and is posted in the category PlusNet News. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.
Hi ive been looking into a solution for this spam blocking as my server is blocked by Ironport. i am a ligitimate business but unfortunetlly i got hacked and my server and ip address got reported. Now that i have had an outside source to resolve the security issues and it is now being monitored constantly my customers cant send anything to Plusnet... My question is... Is there a way that i can get whitelisted.
Cheers
Chris
So this new system might explain why I can no longer - as of yesterday - send mail to my ex-wife!! I am using Plusnet as my ISP and so is she. I am mailing from my BT Internet (Yahoo) webmail client to her Plusnet email address and seeing the mail returned - allegedly due to my IP's poor reputation! Great improvement!
Hi Richard,
It'll be the IP address for the BT Yahoo SMTP server that the webmail platform uses that will have the poor reputation, and it's senderbase that decides which reputation is allocated to an IP address based on how much SPAM is sent from it. It's not particularly surprising that a webmail SMTP server has a bad reputation - unfortunately public servers such as this are prone to abuse by spammers.
Here at Plusnet we're always trying to use clever open source things to make our lives easier. Sometimes we write our own and make other people's lives easier too!
We sell broadband, phone, VoIP and more to homes and businesses in the UK. Winner of 9 out of 11 Categories in the 2008 USwitch survey. Winner of "Best Consumer ISP" at 2008 ISPA awards. Voted number 1 in the Broadband Choices 2008 survey.
© Plusnet plc All Rights Reserved. E&OE
Community Site News is powered by WordPress
