LogSat Software's SpamFilter

We created SpamFilter in desperation to implement what our SMTP server lacks: DNS-based anti-spam features.

SpamFilter's implementation is very simple. It's use is designed for ISPs and companies running their SMTP servers, not end-users. SpamFilter is designed to be your incoming SMTP server. It receives all emais addressed to your domain(s). If the sender's IP is not listed in one or multiple DNS-based block lists, the email is then forwarded to your main SMTP server. Please look at the technical details for more information.

You can download SpamFilter free of charge here. SpamFilter runs on Windows and Linux systems, both distributions are included in the download. The product is fully functional, it has no expiration dates, no nag boxes. You may evaluate as long as you wish. If you do decide that it is helping you substantially reducing the spam, we ask that you purchase a license for it's use.

How it works

Basic operation for SpamFilter is as follows:

SpamFilter is configured to handle your primary MX record for incoming emails (see details here). Email comes in addressed to your domain.

SpamFilter check the IP address initiating the connection. If it is listed in one of it's many DNS blocklists the connection is refused. DNS blocklist site entries can be added at any time in the configuration file.
- If the IP is blacklisted, but you really need to be able to receive email from that domain anyways, the domain can be added in an exclude list as to allow it to bypass the blocklist rules.
If the IP passes the DNS tests SpamFilter then checks the recipient domain. If the domain is listed inthe configuration file as an allowed domain, then the recipient is accepted. This is done to prevent spammers to use SpamFilter to relay. You can bypass this check if you wish (see configuration file for sample and details).
SpamFilter can then optionally check to see if the recipient address has a % sign in it. Many SMTP servers are susceptible to being tricked into relaying with this. Ex. if you are isp.com, then a spammer could try to use joe%yahoo.com@isp.com to relay mail to joe@yahoo.com if your server is vulnerable
If all tests pass the email is forwarded to your SMTP server.

Tech Details

In order to use SpamFilter properly, you need to configure your SMTP setups in such a way as to let SpamFilter handle all of your incoming email for the domains you want it to handle.

The best way to show it's use is probably with an example. Let's assume that you are a very small ISP (isp.com) running your own SMTP server (mail.isp.com). Let's also assume you have a customer hosting with you the domain logsat.com. Your SMTP server also handles this customer's email. All your customers have their email clients configured to use mail.isp.com as their SMTP server (and you probably don't want to have them all reconfigure them).

The MX record for isp.com may look something like:

isp.com MX preference = 0, mail exchanger = mail.isp.com
mail.isp.com       internet address = 209.26.140.2

While the MX record for logsat.com may look like:

logsat.com MX preference = 0, mail exchanger = mail.isp.com
mail.isp.com       internet address = 209.26.140.2

To implement SpamFilter with minimal impact you would do the following.
Run SpamFilter (on the same server or on a separate one) to listen on a different IP, for example on 209.26.140.4, and let's assign mail2.isp.com to it.

Reconfigure the MX records as follows:

The MX record for isp.com now looks something like:

isp.com MX preference = 0, mail exchanger = mail2.isp.com
isp.com MX preference = 10, mail exchanger = mail.isp.com
mail.isp.com       internet address = 209.26.140.2
mail2.isp.com       internet address = 209.26.140.4

While the MX record for logsat.com will look like:

logsat.com MX preference = 0, mail exchanger = mail2.isp.com
logsat.com MX preference = 10, mail exchanger = mail.isp.com
mail.isp.com       internet address = 209.26.140.2
mail2.isp.com       internet address = 209.26.140.4

What happens after these changes? The whole world will see that your primary MX record points to the IP on which SpamFilter listens on. They will send emails to that. SpamFilter will then forward legitimate emails to your SMTP server at mail.isp.com. Your existing customers who have mail.isp.com for SMTP server in their email client configuration will still use that as their SMTP server, nothing will have changed for them. Aside for receiving barely any spam at all!

Purchase

SpamFilter can be licensed for $100 / production server. You may freely use it for development/evaluation purposes.

You may contact us at sales@logsat.com or visit our website at www.logsat.com/SpamFilter for any questions