Foiling Email Harvesters and Coping with Spam

A very interesting discussion at Slashdot earlier this month about how to stop spam.

There were many suggestions involving images with obscured characters, but that's just not acceptable for business.

A lot of these suggestions are fine for personal sites; but if you're actually in business they aren't practical.We use Javascript. You don't want to make life more difficult for the person trying to correspond - the point is to raise the cost to the spammer. If they have to add a Javascript parser to their spider, it's going to slow them way down. It's not going to make financial sense for them to do a custom solution for each site (and if they do, the "image" methods will break down as well).

What do we do for our own clients to lighten the spam load?

1. automated javascript encoding of all the online email addresses on each website
2. catch-all is automatically discarded - this does mean we have to keep careful track of all issued live addresses, both past and present
3. Custom Spamassassin install
   1. spam threshold set reasonably high - at least a five - but what is categorised spam is blackholed (thrown away without turning up ever in anybody's email box)
   2. removing the appropriate filter scores for real estate, mortgages or insurance
4. manual local filters for image/gif processing email into a probable spam folder
5. we also recommend clients use a local Bayesian spam filter within their email client for post server processing
   1. Apple's Mail comes with one built-in
   2. Eudora Pro comes with one built-in (that's what I use)
   3. Thunderbird comes with one built-in
6. all mobile devices (i.e. blackberries) pick up email after server side spam filtering

This works very well but not well enough.

The local probable spam filter does wonders to keep out a lot of spam. Some of my own addresses which were issued by institutions or compromised at the wrong time seem to get a lot of very difficult to filter spam. I don't want to just turn them off, as the few letters I get on these addresses can be quite important.

The final special sauce to really cut down spam which I'm using personally comes from a company called emailias. Any mailing list or commercial site to which I sign up, gets an emailias rather than a real address. I've had a few of them sold on to spammers. It's a joy to be able to pull the plug on them any time I like. Twenty dollars per year is a pittance for full control over almost all of one's incoming email.

What's nice about emailias is how quick-loading and easy-to-use the site is. I wish they would do an aesthetic makeover but it's great that emailias just works.

I will be adding emailias as a company account in short order. And rolling it out to all clients.

If anyone can add anything to the above list, the war against spam is an ongoing campaign and I am always happy to improve our process.

Alec Kinnear

Alec has been helping businesses succeed online since 2000. Alec is an SEM expert with a background in advertising, as a former Head of Television for Grey Moscow and Senior Television Producer for Bates, Saatchi and Saatchi Russia.