4 ms·
I run my own email server in part so I could implement a spam filtering strategy that had access to my outgoing mail. Anything received from someone I sent mai
by lisper 4y ago
I run my own email server in part so I could implement a spam filtering strategy that had access to my outgoing mail. Anything received from someone I sent mail to is assumed non-spam, and that is the anchor for the rest of the filtering.
I was planning to build a pretty sophisticated bayesian filter on top of that but it turned out to be unnecessary. The strategy I ended up with, which has served me well for many years now, is:
1. Block a small number of extremely spammy TLDs. There are about a dozen of these, including .biz, .casa, etc.
2. Anything received from someone I've sent mail to, or a sender I've previously marked as good, is assumed good.
3. Anything received from an address whose name contains an English word on a relatively short list of spammy words (discount, offer, etc.) is assumed spam.
4. Anything received from an address that I have received email from before and not marked as good is assumed spam.
That leaves emails from addresses that are sending me email for the first time. These are overwhelmingly spam, but after the four filters above there are few enough of these that I just scan them manually once a day or so.
The real key here is treating the first email from any given address as essentially a "contact request" with the default action being "deny in the future". That just turns out empirically to work incredibly well. More than 90% of my spam is from repeat offenders.
- deleted 4y ago[deleted]
- Dalewyn 4y ago>1. Block a small number of extremely spammy TLDs. There are about a dozen of these, including .biz, .casa, etc. Honest question: Is there any reason to not just blacklist all emails from TLDs that aren't the Big Four (.com, .net, .org, .gov) and country TLDs (eg: .co.uk, .jp, etc.)? I can't recall ever needing, let alone wanting, email from the later TLDs like .biz or any of the bloody stupid new TLDs that comprise entire words.
- yieldcrv 4y agoas someone that’s never needed SEO perks of a .com since none of my customers would use a search engine to find me (they’ll click thru from posts and ads on social media and group chats) I typically register both a new TLD and a .com, and I use the .com for the email campaigns and reply-to if it gets flagged that doesnt affect my more official one-to-one emails from the actual domain so I would say, maybe? because I’m not allergic to “bloody stupid” TLD’s and have already adapted to what you’re wondering about
- ZhadruOmjar 4y agoThere are lots of businesses using `.io` `.ee` `.co` etc that depending on your email use-case would be detrimental to block especially if you're doing any kinds of business or outreach.
- NickNameNick 4y agoThose are country code TLDs
- mthoms 4y agoIn name only. Domains with those TLDs are available to anyone willing to pay.
- DangitBobby 4y agoThis was in the original comment: > Honest question: Is there any reason to not just blacklist all emails from TLDs that aren't the Big Four (.com, .net, .org, .gov) and country TLDs (eg: .co.uk, .jp, etc.)?
- lisper 4y agoI personally have a dot-email address. And you left out dot-edu. And I get a fair bit of ham from other weird TLDs. So I think a whitelist is a bad idea. But that's because I prefer to have some spam get through than have ham get blocked by mistake. Even with my very sloppy algorithm, the only time spam ends up in my inbox is if a spammer spoofs one of my contacts, and that is extremely rare.
- jenadine 4y agoMy company has a .tech domain.
- mcluck 4y agoI setup my website and email at a dot-tech because, surprise, I work in tech and the equivalent com and io were taken and/or prohibitively expensive
- sveme 4y agoThere‘s also the fancier new stuff like .ai and .io.
- remedan 4y agoAren't both of those country TLDs?
- cassianoleal 4y agoYep, .ai is the TLD of Anguilla (United Kingdom) and .io is British Indian Ocean Territory (United Kingdom). https://en.wikipedia.org/wiki/Country_code_top_level_domain https://en.wikipedia.org/wiki/Country_code_top_level_domain
- sveme 4y agoOh, wasn‘t even aware. Today I learned.
- derefr 4y agoAs a B2B SaaS company, most of our legitimate, paying customer base uses .app or .io domains.
- omnicognate 4y ago.co.uk isn't a country TLD, .uk is. If you block .ac.uk you'll block every UK university, .gov.uk the UK government and if you block .me.uk you'll block, well, me.
- account42 4y agoThat's exactly the kind of arbitrary bullshit policy we don't need more of.
- yarg 4y agoThrow a honeypot into the mix. Anything that reaches addresses that you don't use gets marked as spam. Common prefixes will work for cases where they're guessing your address, and hidden mailto links will cover situations where they're scraping your webpage.
- wyclif 4y agoKind of semi-tangential, but you mention .biz and .casa. What are the other most spammy TLDs you've encountered?
- lisper 4y agoHere is the complete list: 'top','tv','biz','rocks','ru','science','bid','date','casa','buzz','work'
- 2000UltraDeluxe 4y agoI'd add .xyz to that list.
- lisper 4y agoYeah, you'd think that would be a pretty spammy TLD, but for some reason I don't get a lot of spam from there.
- cornholio 4y ago> "heuristsics, shared models, and tea-leaves" I have no idea how blocking TLDs of entire countries with hundreds of millions of citizens can be considered a valid anti-spam advice. Just like the parent comment explained, you are actively pushing all of those people into the hands of Gmail (or Yandex in this case).
- bityard 4y agoI run my own mail server too. Rspamd does a reasonable job of cutting back the amount of down that gets though, but I feel like I have no control over it or visibility into what it's doing. What tools are you using to implement the controls you describe above?
- lisper 4y agoI rolled my own. It consists of Postfix, Dovecot, a custom milter written in Python, some small sieve scripts, and the spam filter written in Clozure Common Lisp using SQLite3 as the database.