Best antispam solution

Well,from my previous organization experience where we used Iron port to filter span on mails. I would recommend you for Iron port.Its a good solution for spam mail filter.

Hi, I always use and recommend the following , since both integrated with Infrastructure especially Exchange servers  


Microsoft Antigen for Exchange 2003 and SMTP gateway + IMF features built in in Exchange 2003 sp2

Microsoft Forefront for Exchange Server for Exchange 2007  + Anti spam built-in in Exchange 2007


Thanks

Not sure if you prefer hardware or software but we use a hardware barracuda unit - and it works pretty flawlessly.

I think I am going to evaluate ORF, thanks alanhardisty. I have actually used the Microsoft products and seen only a cut by 50%-60% of spam, even Postini (despite its current issues) achieves 96%+ it used to be 99.9% but its been getting weaker for a while on most of my clients. I have also seen Red Condor elsewhere and am going to try that too. Iron Port is way too expensive.

If you do trial it and you don't get good results - let me know and I can assist you with tweaking it so that hopefully it can work as well as mine.

alanhardisty,

How much do you have to tweak it, I have around 10 clients who would have the solution immediately and maybe another 40 interested. I really haven't the time to spend tweaking anti-spam settings (its why I currently have most of them on postini). Once set up I would it run for say a year without further changes?

Sure - once it is setup - leave it alone.

I am thinking more about how zealous you want to be.  There are lots of ways to block spam with Vamsoft and it depends on your choices as to the tests you setup initially.

You could just leave it at greylisting and that would reduce it by a large amount, but you can use IP Blacklists, URL Blacklists, Use Recipient Validation, Use Reverse DNS lookups to reject those without RDNS setup, Honeypots, etc, the list is quite extensive.

There is filtering before arrival and on arrival or both, plus tarpit delay and all these can be setup.  It all deends on the environment and there is a best practise guide for differing configurations.

The only tweaking I have done is to filter the logs on the Invalid Recipients list, check the ones with lots of invalid recipients to the same name and adding those invalid recipients to the Honeypot list.  This can then block the sending IP for a specified period of time.

You can just set it and forget it - I like to tweak!

We have changed from GFI to Barracuda.  Been using it for about an year now, the only problem we have faced so when my Director changed a pssword which we used to tie the Barracuda to AD (LDAP).  Other then that, its been great.  Also the few times I had to call their tech support, I spoke with a tech from Colorado which for us was a good thing.

Were using a Barracuda 400.  Its able to handle up to 700,000+ spam messages each day with no problem.

http://www.barracudanetworks.com/ns/products/spam_overview.php

What are the specific requirements of the solution?  You want to block spam and limit falst positives, of course; but do you also want customers to receive a daily email showing them what's in spam and giving them the option to pass thru, whitelist, delete, etc?  Or do you just want it to block spam and not bother the user?

If you want customers to have a portal to log in and view spam, IronPort (as previously recommended) is an excellent solution, works a treat.  The drawback is cost; Cisco is quite proud of that software, it's very expensive.  Another good one is the Barracuda appliance, it's a great one, but again, quite expensive.  

For a customer portal, I'd recommend a hosted solution.  In Haus has a nice solution, it's a hosted Barracuda appliance, I've seen very good results from it.  MX Logic also does  a pretty good job, but there are more false positives than I'd like.

If you can live without the customer portal, I recommend spamhaus.org.  It's a free service, you need only put something in front of your exchange server that will query RBL servers, and use zen.spamhaus.org and your RBL, and you're done.  It works beautifully - never seen a false positive, spam is virtually non-existant with it - and it doesn't cost any money.  I donate money monthly to them, but none is required.  They'll keep track of you though, so if you host 3000 mailboxes or something, they'll want you to pay their enterprise costs.  But if you're setting up customer servers, use spamhaus (provided they don't need the portal).  I've talked customers into trying it, and they've quickly found that the portal is an unnecessary nuisance and waste of time.  With Exchange 2007, you can have the mail server itself query RBLs, use spamhaus and you simply won't get spam.  With prior version, you'll need to put something in front of the server that will query RBLs.  The symantec gateway works ok, turn off all the heuristic detection, just use RBLs, hit spamhaus, you're golden.  Stay away from the McAfee SIG appliance, imho.  

I also have experience with Red Condor - they also work quite well.