Anti SPAM and Antivirus protection trial [Archive]

charles

10-07-2005, 11:40 PM

We are looking for candidates to test a new service we are exploring - outsourced Anti SPAM and Antivirus protection.

What is it?

We provide protection against spam and viruses. We take care of keeping it up to date with the latest anti-spam and anti-virus technology boasting to catch > 95% of SPAM with less than 1 in 1,000,000 false positives. This is done by using our server as your primary MX server, which processes the emails for spam and viruses, and then sends the mail to your current MX server. You get full control with a login to allow you to control rules such as to just tag the email headers so you can filter them yourself, change the subject or even quarantine spam and emails containing viruses. You also get detailed statistics and reports on your email processed.

But Why?

Besides taking a lot of work off your plate keeping up with the spammers, it will eliminate unnecessary load on your server! With this service, you wont need to run spamassassin, boxtrapper, clamAV or doctor web on your VPS, saving those resources for other tasks.

Do I qualify?

Glad you asked. We are looking for people who get **a lot** of email, and **a lot** of SPAM and viruses. You need to have control of the DNS for your domains, as you will need to modify your MX record to try this.

Whats the catch?

There isn't one. All we ask is that you give us your feedback - tell us how effective it was, how easy/hard it was to use, and if you like it, what you'd pay for a service like this.

Interested? Please submit a ticket to support@defenderhosting.com telling us you'd like to participate. We'll need a list of domains you'd like protected, and for each domain the current MX server IP. We'll setup the filtering and give you a login to allow you to customize your settings (although it will work just fine without any). All you have to do is change the MX for those domains and say bye bye to spam and virsues.

It's that easy.

ndndixie

10-07-2005, 11:54 PM

Question:
Is full privacy for clients e-mail maintained? I know it will be asked so I might as well find out.

charles

10-07-2005, 11:59 PM

Administrators (you) have the ability to see quarantined emails, and redirect spam or emails containing viruses to an email address of their choice. Other than that, all that is collected are general statistics on the email, like the number of emails processed, how much was spam, etc.

Our administrators have the same abilities as above.

hth
charles

ndndixie

10-08-2005, 12:01 AM

As long as it's y'all and not a third party somewhere on a little island run by a man with a cigar. I sent an email to my biggest clients asking if they'd like to try it. I'll send a ticket to support in the am with the domains to add.

charles

10-08-2005, 12:11 AM

Nope it's just us. We do enjoy a cigar every now and then though.... :p

elix

10-08-2005, 03:39 PM

Could this also be used to queue mail? Say I have a redundant DNS setup on my VPS and my mail server goes down but it reaches yours...will your mail server then queue the mail and deliver the legit mail to my mail server once it's back?

charles

10-08-2005, 03:41 PM

Could this also be used to queue mail?

No it is purely a filter.

Edit: Well, technically it will hold mail and keep retrying for a period of time (which I am not sure what that is right now). This is no different that without it, except that you can be assured of knowing how long it will queue the mail before rejecting.

So as long as it queues mail for a decent period, it is in fact better than not having it in this regard.

charles

elix

10-08-2005, 04:02 PM

Thanks for such a quick response!

Is there any limit on the amount of domains that we can use this for?

Fred

10-08-2005, 04:23 PM

I do not fit in the requirements... i'm about 200emails a day :)
For about 20 domains... and 75% if not 85% is spam... !!

But that's a service i will probably use when it will be available to any powervps customers! Mailscanner is big hit sometime on the cpu... It's pretty cool for 200emails a day, but i can't imagine how my vps will be hit if it serves 20 000mails a day! :)

Also, the elix's comments is interresting... It's not a backup mx but will work as it is one. The RFC say it's should be 4 or 5 days before it give up... that's more than what we need... I don't know what should be the value for a "relay" like this... but i'll be pretty happy to know that if my server goes down, i will have at least no mails lost for X hours... Better than no backup mx at all...

elix

10-08-2005, 04:29 PM

Fred

10-08-2005, 05:13 PM

just to be sure... redundant dns is a secondary (or third) located elsewhere than in my vps right ? and better if it's located in another datacenter ...

elix

10-08-2005, 05:42 PM

just to be sure... redundant dns is a secondary (or third) located elsewhere than in my vps right ? and better if it's located in another datacenter ...
Yes and Yes :)

elix

10-08-2005, 05:46 PM

hmm...this also brings something else to mind. Maybe PVPS should offer a backup DNS service? (obviously for an added fee)

charles

10-08-2005, 05:52 PM

I do not fit in the requirements... i'm about 200emails a day :)
For about 20 domains... and 75% if not 85% is spam... !!

But that's a service i will probably use when it will be available to any powervps customers! Mailscanner is big hit sometime on the cpu... It's pretty cool for 200emails a day, but i can't imagine how my vps will be hit if it serves 20 000mails a day! :)

You can try it. just email support.

Also, the elix's comments is interresting... It's not a backup mx but will work as it is one. The RFC say it's should be 4 or 5 days before it give up... that's more than what we need... I don't know what should be the value for a "relay" like this... but i'll be pretty happy to know that if my server goes down, i will have at least no mails lost for X hours... Better than no backup mx at all...

Will get back to you once we know how long it will hold, but yes it will hold and that has some value once you know how long :)

charles

charles

10-08-2005, 05:58 PM

hmm...this also brings something else to mind. Maybe PVPS should offer a backup DNS service? (obviously for an added fee)

We are looking into this but the only solution we have right now is a power-0 vps. If you use cpanel, we can setup dns clustering and it's seamless. With anything else it would require manual maintenance on your part.

hth
charles

elix

10-08-2005, 06:30 PM

We are looking into this but the only solution we have right now is a power-1 vps. If you use cpanel, we can setup dns clustering and it's seamless. With anything else it would require manual maintenance on your part.

hth
charles
True, but the Power-1 would be on the same network..:/

charles

10-08-2005, 06:51 PM

I meant power-0, and yes at this time it would be in the same datacenter.

ndndixie

10-08-2005, 07:06 PM

You say "at this time".....lol is there hidden meaning behind that?

elix

10-08-2005, 07:38 PM

Are you going to charge for this service after it passes the "introductory" stage?

Also, is it actually a mail server "cluster" or is it just a single server?

charles

10-08-2005, 08:09 PM

You say "at this time".....lol is there hidden meaning behind that?

We operate out of both San Jose as well as Chicago, and have had VPS in more than one datacenter before. So if there is sufficient demand, there is no reason we won't do that again in the future.

Are you going to charge for this service after it passes the "introductory" stage?

Yes. The whole point of the trial is to guage interest and determine pricing. All you have to do is change one line in the zone fiel for each domain. Trivial to try and trivial to backout if you dont like it or don't want to pay.

Also, is it actually a mail server "cluster" or is it just a single server?

This is a single server capable of handling a high volume of email. We are exploring clustering options.

charles

charles

10-08-2005, 08:12 PM

Is there any limit on the amount of domains that we can use this for?

Sorry this wasn't answered earlier. No limit.

hth
charles

Hvu

10-09-2005, 04:00 AM

I want in (:

charles

10-09-2005, 08:03 AM

I want in (:

Email support then!

elix

10-09-2005, 10:08 AM

Question,

Could this be used to scan outgoing mail as well to reduce SPAM overall on the entire network? :)

charles

10-09-2005, 10:54 AM

Question,

Could this be used to scan outgoing mail as well to reduce SPAM overall on the entire network? :)

It is possible, but we will not be offering it at this time.

charles

charles

10-09-2005, 04:59 PM

Just FYI, we have noticed an issue with cpanel servers (and may not be constrained to it).

The default setting for handling viruses is to quarantine the email and notify you. These notification emails are being sent from postmaster@yourdomain to you@yourdomain. exim doesn't like our mail server lying about being yourdomain, and rejects them. So the net result is no notifications for quarantined mail right now if using cpanel.

We'll let you know when we have a resolution.

charles

Hvu

10-09-2005, 07:04 PM

hrm, I'm waiting for my DNS to change over my MX records but I cant login to the panel.

charles

10-09-2005, 07:13 PM

If you got an error saying you didn't have any domains to manage, try now (my bad). If you can't login at all, reply to your ticket.

charles

charles

10-10-2005, 02:41 PM

The root of the issue is that cpanel servers do not **accept** email to postmaster@yourdomain by default (despite RFCs saying you should) which is causing them to also deny email **from** postmaster@yourdomain. So if you use cpanel or any other server with this setup, you will need to accept mail for postmaster@yourdomain.

Just FYI, we have noticed an issue with cpanel servers (and may not be constrained to it).

The default setting for handling viruses is to quarantine the email and notify you. These notification emails are being sent from postmaster@yourdomain to you@yourdomain. exim doesn't like our mail server lying about being yourdomain, and rejects them. So the net result is no notifications for quarantined mail right now if using cpanel.

We'll let you know when we have a resolution.

charles

charles

10-10-2005, 02:41 PM

It will hold mail for up to 5 days.

charles

No it is purely a filter.

Edit: Well, technically it will hold mail and keep retrying for a period of time (which I am not sure what that is right now). This is no different that without it, except that you can be assured of knowing how long it will queue the mail before rejecting.

So as long as it queues mail for a decent period, it is in fact better than not having it in this regard.

charles

vwiley1

10-13-2005, 02:20 AM

Would this service handle dictionary attacks?

I have a client that gets 1000-10000 emails sent to almost every name possible at his domain.

aaa@domain.com
aab@domain.com

Second question:
I have setup a RBL that helps with preventing dictionary attacks. If e-mail gets sent from one person to X number of non-existant accounts on the server, then their IP is banned from exim.

Your service should effectively filter out these dictionary attacks because they all are spam messages for viagra and other things I won't mention here. BUT... If your service does not happen to filter out a large mailing, would my RBL block the filtering servers IP or would it block the original senders IP? If it blocks your IP then obviously that would be bad because nobody would get email.

If you have any questions about my setup just let me know.

charles

10-13-2005, 03:54 AM

Would this service handle dictionary attacks?

I have a client that gets 1000-10000 emails sent to almost every name possible at his domain.

aaa@domain.com
aab@domain.com

Yes. You can configure it to only allow specific addresses and therefore stop it even trying to deliver those to your machine.

Second question:
I have setup a RBL that helps with preventing dictionary attacks. If e-mail gets sent from one person to X number of non-existant accounts on the server, then their IP is banned from exim.

Your service should effectively filter out these dictionary attacks because they all are spam messages for viagra and other things I won't mention here. BUT... If your service does not happen to filter out a large mailing, would my RBL block the filtering servers IP or would it block the original senders IP? If it blocks your IP then obviously that would be bad because nobody would get email.

If you have any questions about my setup just let me know.

I am not sure about this. One way to find out :)

charles

Hvu

10-18-2005, 12:57 AM

Loving it (: 100% spam / virus detected so far. Not too hard to setup. Just put mx record to 10 and your old mx to 20. The virus detected email is great to, but Be better if there was one every week or day rather each time getting it, It gets annoying sometimes (;

charles

10-18-2005, 01:08 AM

Loving it (: 100% spam / virus detected so far. Not too hard to setup. Just put mx record to 10 and your old mx to 20.

Good to hear.

The virus detected email is great to, but Be better if there was one every week or day rather each time getting it, It gets annoying sometimes (;

This was a poorly chosen initial setting, but you can change this yourself under MessageIQ Settings -> Quarantine Options. Choose delta and daily.

hth
charles

Fred

11-03-2005, 06:55 PM

Hi guys,

Any date about the official launch of this service ? Any informations about prices ?
Else, if this infos isn't available, any infos about the beta test ? How is it going ?

FFR

11-07-2005, 08:30 AM

My question:

The Filters work for english only or for the other languages too?

charles

11-07-2005, 11:03 AM

Fred, no launch date yet, or pricing. We haven't gotten enough feedback on what value people see in the service yet. We will send an email blast to all customers to get more feedback, but are waiting until after the server moves to do so.

FFR, I'll let you know as soon as I get confirmation, but I don't think it supports utf-8 (so ascii only).

charles

UPDATE: The user interface is ascii only right now, but their own built in filters support multi-byte character sets.

Hvu

11-08-2005, 12:12 AM

Its great, I love it! I think a cool plan would be to host only email and use spam filter. I would totally do that, just have my email be routed here but then need to sync with cpanel and etc. =\ Unless someone already has this script/program.

attilas

11-08-2005, 12:29 AM

This block 75-85% of spams at mine. A server side Spamassassin seems to have better result, but consume server resources. I'm waiting for a price plan.

ozgreg

12-01-2005, 08:57 PM

Any plans on this Charles?? as I am just weighing up installing ClamAV and Mailscanner on my VPS box over utilising a service like this..

charles

12-01-2005, 09:03 PM

We are still testing but are happy with it's performance. We'll get a second one for redundancy before charging for it.

We do need more feedback from the participants regarding what they think the service is worth to them - so do let us know.

charles

ozgreg

12-01-2005, 09:18 PM

Can I subscribe to it then and give you some feedback???

charles

12-01-2005, 09:20 PM

Yes, absolutely. Just email support, providing the info I requested earlier in the thread and they will take care of you.

charles

ozgreg

12-04-2005, 07:10 PM

Firstly I will say I am impressed at the concept of this offering and it is really is in the interest of everyone to have better filtering on the email just from a point of view of reducing the amount of spam being sent to your inbox..

Overall the interface is "pretty", clean and easy to navigate. Reporting has lots of graphs etc but lacks any meaningful drill down to really see where the spam is coming from (see http://mailwatch.sourceforge.net/ ) for a better report where you can see the mail coming in and out (just the headers) and how the spam was tagged.

You have options to set up your own filtering and the option to send spam / virus to quarantine feature is excellent concept, with the ability to send you reports tagging new spam or all current messages in your Quarantine.

I did notice a huge oversight in the spam filtering system, it seems to lack one of the most critical features, spam scoring.. Basically you have no way to scoring spam which is a huge disappointment, thus you cannot set any filtering based on scoring for options like score over 7 trash, over 2 to 7 quarantine, and under 2 deliver, in fact the spam filtering in the system is like a black box you can set up some manual filters but it seems impossible to see why a message has been tagged as spam etc or how you can tweak those settings..

Overall I view the anti spam offering as a really solid concept however the lack of spam scoring / detailed message filtering reporting makes it hard to want to pay for this service, the system really needs scoring settings to better control how spam is tagged and what happens to spam after that..

charles

12-04-2005, 09:23 PM

Thanks for the excellent feedback!

charles

ozgreg

12-04-2005, 09:40 PM

Thanks for the excellent feedback!

charles

Thanks Charles, I am impressed that you are considering to offer this service as it would stop Clamav/spamd running off our machines..

I am just baffled over why in the heck the spam scoring is not utilised, unless it is some option that was not turned on??

charles

12-04-2005, 09:44 PM

Yeah, thats one of the first things I told them. That and the ability for use to set a number of domains and let you manage them yourselves.

It's not an option right now, but I'll ask if it's in the works anytime soon.

charles

Hvu

12-05-2005, 11:06 PM

Some viruses got pass the server. Anyway to report it?

ozgreg

12-06-2005, 12:31 AM

Suggest sending the header information to support

ozgreg

12-06-2005, 12:34 AM

charles

12-06-2005, 12:41 AM

hvu, not sure yet, but will tell you once I find out.

ozgreg, as always, thanks!

Regarding scoring, MailFoundry's stance is that by design they don't have scores, and nor should you need them. In their words

"Our human intelligence approach eliminates the need for scoring and
parameters, statistical based approaches etc. One of the main premises
around our solution is hands off for end users."

charles

ozgreg

12-06-2005, 03:27 AM

Regarding scoring, MailFoundry's stance is that by design they don't have scores, and nor should you need them. In their words

"Our human intelligence approach eliminates the need for scoring and
parameters, statistical based approaches etc. One of the main premises
around our solution is hands off for end users."

charles

Well that is kind of disappointing Charles... judging from my past experiences, closed systems tend to only be to the advantage of the vendor rather than the customer.

PS: Did you see the global stats of just under 50% of all mail was spam or virus

nadzri

12-06-2005, 07:20 AM

charles

12-06-2005, 10:55 AM

Well that is kind of disappointing Charles... judging from my past experiences, closed systems tend to only be to the advantage of the vendor rather than the customer.

PS: Did you see the global stats of just under 50% of all mail was spam or virus

Well, it's the price you pay for having a hands off solution. I think it's going to boil down to whether or not it does a good enough job for you.

charles

charles

12-06-2005, 10:55 AM

charles

12-06-2005, 12:23 PM

Some viruses got pass the server. Anyway to report it?

No, sorry they don't.

charles

charles

12-06-2005, 12:32 PM

Found an interesting bug -> http://mailfoundry1.defenderhosting.com/reports.phtml?section=stats shows all your mail for the month for all your domains which is useful (but again lacking details) however if you click on detailed breakdown you get the GLOBAL stats for the entire mail server rather than the detailed breakdown for your account..

Greg, I cannot reproduce this. Please double check and if you still see this, PM me your password so I can login as you and see for myself.

charles

ozgreg

12-06-2005, 06:18 PM

Greg, I cannot reproduce this. Please double check and if you still see this, PM me your password so I can login as you and see for myself.

charles

On the http://mailfoundry1.defenderhosting.com/reports.phtml?section=stats Window you will see breakdown by month then over on the far right hand side detailed breakdown

Click on the detailed breakdown (under admin) and you will see the global stats for the box

http://mailfoundry1.defenderhosting.com/stats_detailed.phtml?qs=section%3Dstats&date=2005_12

I found where the account stats are, you click on the month

http://mailfoundry1.defenderhosting.com/stats_domain.phtml?qs=section%3Dstats&date=2005_12

I will PM my details for you to look...

ozgreg

12-06-2005, 06:31 PM

Why is scoring so important if it does the job?

Sorry to butt in, I am not subscribed to the service but have become interested since a day or 2 ago.

If there is a false positive/negative, can you redirect the email so that later on the system tags it correctly? (Report ham/spam).

Yes you can, I send all my spam to quarantine, the issue is some HTML newsletters and "joke" emails do get caught up in spam filters it is just the nature of the filters and no filtering system will ever be perfect in this regards.

Under systems like mailscanner, you can make a judgment on how high a rating of spam before taking certain kinds of actions, something you cannot do in MailFoundry, instead you need to monitor quarantine to make sure no real emails have been caught and I miss having that flexibility of being able to control what happens with SPAM..

As Charles said, no system is going to be perfect and it is a matter of degree's. For me Mailscanner is a slightly better system but it's downside is it is a HUGE system resource hog..

charles

12-06-2005, 06:48 PM

On the http://mailfoundry1.defenderhosting.com/reports.phtml?section=stats Window you will see breakdown by month then over on the far right hand side detailed breakdown

Click on the detailed breakdown (under admin) and you will see the global stats for the box

Ok, i see you get much larger numbers than if you drill down to the month, but that's not the box totals. The box totals are many million emails handled each month :)

FWIW, the numbers are accurate for my own account. I'll have them look into why your seeing this on yours.

Thanks again
charles

ozgreg

12-06-2005, 07:09 PM

Ok, i see you get much larger numbers than if you drill down to the month, but that's not the box totals. The box totals are many million emails handled each month :)

FWIW, the numbers are accurate for my own account. I'll have them look into why your seeing this on yours.

Thanks again
charles

Damn I thought it was only ndndixie that had weird unexplained things.. or is that she is just weird and unexplainable ... Either all ;-)

PvUtrix

12-07-2005, 09:32 AM

ozgreg

12-07-2005, 06:42 PM

At the moment Mailfoundry is useless against Russian spam, I've already received over 20 emails incorrectly marked as ham :(
I've been forwarding all the letters to spam@mailfoundry.com, so hopefully they will take care of it. Now it's showing a ratio of 89% ham, whereas in reality it's 5%.

For now all I can say is that SpamAssassin has been protecting my mailboxes much better, against russian spam.

Thanks for the update, lets hope mailfoundy respond in kind.. I really really wish they implemented a scoring system, SpamAssassin has proved such a system works well against all types of spam...

charles

12-07-2005, 09:33 PM

ozgreg

12-07-2005, 10:48 PM

I personally think that like addressing security, you need to think in terms of layers of defense against spam. This is an excellent first cut/triage. It will reduce 90+% of the unwanted traffic, reducing the resources required on your server to keep using SA or whatever your tool of choice is as a second step.

Since we have seen zero false positives, I think the MailFoundry is doing an excellent job, and can be trusted to drop any spam it detects.

charles

I agree, I seen zero issues in terms of trapping emails it should not have trapped and will continue to utilise other tools as well..

Although I not noticed a big drop in resources the 15-30% drop in email traffic alone makes a nice change..

I see that product like these will be come the "cisco" routers for email designed to act as first defense against the flood of email traffic carried around the world..

PvUtrix

12-08-2005, 04:55 AM

I'm not satisfied at all up to now... I've sent about 100 or so spam emails to mailfoundry guys already... Today 30 got through, only 3 got marked as SPAM :(

I'm gonna wait for another few days and if the situation doesn't change, I will go back to SpamAssassin for now and then maybe give it another try later...

charles

12-08-2005, 09:23 AM

What kind of spam is it missing?

PvUtrix

12-08-2005, 03:25 PM

What kind of spam is it missing?
Spam letters targeted at russians(i.e. in russian). Would you like me to forward you some? :)

SpamAssassin was doing a great job at marking them, only 1-2% got through, here the situation is completely opposite, 1-2% get marked correctly, the rest are getting through...

I've submitted over 150 emails to mailfoundry guys so far, maybe they just needed some russian letters to "teach" the system and they will hopefully start blocking them...

charles

12-08-2005, 05:19 PM

I'll check into it.

charles

charles

12-08-2005, 09:44 PM

PvUtrix, they basically said to keep sending them and it will improve. They are also testing a new version of their spam killing engine which is supposed to do a better job on those.

hth
charles

ozgreg

12-08-2005, 09:44 PM

Suggest you also check your email headers for

Received: from mailfoundry1.defenderhosting.com ([205.234.111.114])

I noticed for some reason two of my domains suddenly stopped being routed by Mailfoundry

Carlos Camacho

12-08-2005, 09:56 PM

I haven't had the time to read each post to this thread in detail, so I might be repeating other users feedback...

>At the moment Mailfoundry is useless against Russian spam,

Yes, I also noticed that I'm getting a great deal of Russian spam as of late. Though maybe I always was, but SpamAssasin was keeping me from seeing it. ;)

I would say that my spam went down 40%, but a great deal still gets through.

I've been forwarding ALL the spam that gets through to MailFoundry. But not sure if it is making a difference. Is all the spam we report building its database so that down the road, it is "smarter?"

On this topic, do I forward JUST the long headers, or long headers+body? Also, is it OK to forward everything "quoted"? Or do I have to remove the quote before sending? Simple question, but I have no idea how Mailfoundry likes the spam that is reported by us.

I wish there was an option to JUNK any email based on its encoding. I'd like to tag Big-5 (Chinese), Russian, and some other languages as SPAM, as I'll never have a legit email encoded in those languages. :D

ozgreg

12-08-2005, 10:10 PM

I would forward both the long header + body as it seems Mailfoundry is utilising a combination of both.. I would also recommend you turn on SpamAssassin to additional filter your email..

charles

12-08-2005, 10:13 PM

I've been forwarding ALL the spam that gets through to MailFoundry. But not sure if it is making a difference. Is all the spam we report building its database so that down the road, it is "smarter?"

On this topic, do I forward JUST the long headers, or long headers+body? Also, is it OK to forward everything "quoted"? Or do I have to remove the quote before sending? Simple question, but I have no idea how Mailfoundry likes the spam that is reported by us.

They apparently have humans use the spam to tune their engine.

They say just to forward, but I would show the full headers.

I was there was an option to JUNK any email based on its encoding. I'd like to tag Big-5 (Chinese), Russian, and some other languages as SPAM, as I'll never have a legit email encoded in those languages. :D

Unless your Chinese, Russian, both, or know people who are :p

charles

Carlos Camacho

12-08-2005, 10:16 PM

Ah, so you have Mailfoundry AND SpamAssasin on at the same time? Hmm... I turned off SpamAssasin when I started to beta test (otherwise, how would I know how well Mailfoundry is working ;) ) I suppose I'll turn it on after the beta test prorgam ends. :D

ozgreg

12-11-2005, 06:30 PM

I been trying to work out if it is possible to combine all the spam quarantine reports together rather than having the reports sent to every email address that has spam. The closest feature I seen so far is the Digest Redirection which is basically for each mail address redirect to this address which is a HUGE pain to setup :(

PvUtrix

12-11-2005, 07:18 PM

Hmm... I've already sent these guys over 300 SPAM letters, but still almost all of it (russian!) goes through...

I'm not sure that I can keep doing this for much longer. This is how my mail box looks now, I was so used to seeing all of these correctly filtered to "Junk mail"...
:)
http://images5.theimagehosting.com/spam.6.th.gif (http://server5.theimagehosting.com/image.php?img=spam.6.gif)

Out of 52 new message, 3 are not spam, 1 got marked as spam...

Strangely SpamAssasin was tagging 95% of this SPAM with pretty much default config...

charles

12-11-2005, 07:22 PM

Thats a lot of Russian spam. Are you russian? Maybe it's a "the bat" thing ;)

ozgreg

12-11-2005, 07:44 PM

Wow that is a lot of Spam.. You might want to stop clicking on the subscribe me buttons on those Russian Girls websites you been visiting ;-)

PvUtrix

12-12-2005, 08:49 AM

Lol :)
I am russian and I use a separate "junk" email address, that I don't even check, for dodgy sites :)

What the bastards are doing is running dictionary attacks, so sometimes I get the same letter on info@*, webmaster@*, support@* etc... not much you can do really... Also considering the databases of the tax authorities with all incomes of all moscovites have leaked and are for sale as well now, I'm sure these guys have very elaborate ways of building their emails databases.

There are no strict laws conserning spam in Russia yet, so it's a big problem. It's very cheap as well, so everyone is tempted by the spammers. I get email from someone selling a car, renting out an appartment etc.... But the databases they use are usually of russian users only, so non russian speakers would not be aware of this...

For instance, this is what I learned from one of the spam letters, the prices are with a Christmas discount :) lol

BUsinesses in Moscow
960.000 addresses - $100

Users in Moscow
2 000 000 addresses - $150

Businesses Russia
3 250 000 addresses -$200

Users in Russia
5 600 000 addresses - $250

So even if 0.01% of the emails are read, it's about $0.1 per email at that rate...

Here's how my mailbox is looking today... (http://server5.theimagehosting.com/image.php?img=spam.7.gif)

80 new, 2 marked as spam :(

Charlie

12-12-2005, 01:42 PM

Anyone having problems with mail just bypassing MailFoundry and going directly to your mailbox?

I have an account that shows 500 or so emails processed, 77 delivered and yet for the same period over 800 were delivered to to mailbox, most of which do not show delivered by mailfoundry in the headers???

At first I thought it was a DNS issue but its now been many days and around half of each day's mail just bypasses my mailfoundry scanning???

charles

12-12-2005, 03:45 PM

Yes!

I wrote it off to being clever spammers - counting on thr fact that your secondary MX doesnt have spam protection.

In the future when we have two of these (clustering not supported yet) this will nto be an issue.

For now you can risk having one MX, or deal with this.

charles

ozgreg

12-12-2005, 05:49 PM

Yes I had the same problem, and decided to take the plunge and remove the MX 20 line.. Still if it goes down I just ask ndndixie to get on Charles case ;-)

Carlos Camacho

12-12-2005, 09:05 PM

The Mailfoundry isn't really working out for me. I think I was happier with simply SpamAssasin. I'll probably ask support to take me off the beta program in a few days.

I'm going to consider 4PSA Spam & Virus solution, which I wrote about here:
http://forums.deftechgroup.com/showthread.php?p=6848
(For Plesk users only)

Cheers,

charles

12-12-2005, 09:14 PM

Carlos, it blocked 62% of your emails as SPAM or virus. Thats 62% less email that needs to be scanned on your VPS as a second layer of defense. Not worth the resources saved?

charles

PvUtrix

12-12-2005, 09:24 PM

This is what I'm seeing after turning on SpamAssassin for the day
http://images5.theimagehosting.com/spam.8.th.gif (http://server5.theimagehosting.com/image.php?img=spam.8.gif)
70 straight to Junk mail, 3 tagged by mailfoundry, indicated by "[SPAM]!", the rest by SpamAssasin afterwards...

Charlie:
Yep, I'm seeing the same problems...

I remember reading about this issue on WikiPedia, quite recently, here's a quote:
A favorite technique of spammers is to connect to the lowest priority MXs for a domain (those with the largest numerical value) in an attempt to avoid any anti-spam filters that may be running on the primary (highest priority) MX. Computer viruses have also been known to employ this technique in an effort to avoid anti-viral software.
http://en.wikipedia.org/wiki/MX_record

So what would actually be interesting is to set mailfoundry as the lowest priority MX , so all the spam is sent there :) Should be interesting :)

charles

12-12-2005, 09:45 PM

So what would actually be interesting is to set mailfoundry as the lowest priority MX , so all the spam is sent there :) Should be interesting :)

Let us know how it goes :)

charles

Carlos Camacho

12-13-2005, 05:24 AM

The Mailfoundry isn't really working out for me. I think I was happier with simply SpamAssasin. I'll probably ask support to take me off the beta program in a few days.

Charles, what I meant to say is.... As I understand the beta test is to test Mailfoundry on its own, thus I turned off SpamAssasin. If I can run both at the same time, then yes, indeed that is ideal.

Cheers,

Charlie

12-13-2005, 10:10 AM

This is a very interesting test and a learning experience. I didn't even know it was possible to send mail to a particular MX level!

Last night I set mailfoundry to the lowest level MX and will monitor Mailfoundry and Mailscanner ( and kmemsize alerts and failures) to see how it works.

My hope is that I can reduce enough load to stop the kmemsize failures I have since adding this particular account to my VPS. I have no other resources that are even close to being maxed out, but mailscanner seems to be hard on kernal memory. I see some improvement with the amount being handled by mailfoundry now. Hopefully if I can get it to handle more mail I'll see more improvement. I am about ready to add one more domain to mailfoundry and document the effects on kmemsize.

Many thanks to The Power VPS team for letting me try this service. Hopefully my experiences will help us all.

charles

12-13-2005, 10:35 AM

Charles, what I meant to say is.... As I understand the beta test is to test Mailfoundry on its own, thus I turned off SpamAssasin. If I can run both at the same time, then yes, indeed that is ideal.

Cheers,

Yes, you sure can.

charles

charles

12-13-2005, 10:38 AM

Hi Charlie

As you probably know by now, we will raid kmemsize for you if needed, but usually what happens is when you raise that limit, you end up hitting another, so you do want to isolate the cause.

charles

This is a very interesting test and a learning experience. I didn't even know it was possible to send mail to a particular MX level!

Last night I set mailfoundry to the lowest level MX and will monitor Mailfoundry and Mailscanner ( and kmemsize alerts and failures) to see how it works.

My hope is that I can reduce enough load to stop the kmemsize failures I have since adding this particular account to my VPS. I have no other resources that are even close to being maxed out, but mailscanner seems to be hard on kernal memory. I see some improvement with the amount being handled by mailfoundry now. Hopefully if I can get it to handle more mail I'll see more improvement. I am about ready to add one more domain to mailfoundry and document the effects on kmemsize.

Many thanks to The Power VPS team for letting me try this service. Hopefully my experiences will help us all.

Charlie

12-13-2005, 11:42 PM

Making mailfoundry the lowest MX number does solve the problem of some spam getting around it.

Today Mailfoundry quarantined 580 spam, 3 viruses and passed 136 emails to my account.
Of the 136, 74 were tagged as Spam by Mailscanner(Spam assassin)

All of the emails I checked had mailfoundry headers.

Carlos Camacho

12-14-2005, 03:03 AM

>Making mailfoundry the lowest MX number does solve the problem of some spam getting >around it.
Ohh... Are there any new recommendations from PowerVPS then, with that in mind?

I'd also like to ask, on my VPS, only one site currently is on the beta test. If at a future date, I'd like all my domains to use Mailfoundry, does it mean editing each one's DNS by hand?

Zaf

12-14-2005, 07:15 AM

I wonder how does lowering the MX priority help. I always thought it would hit the lower priority server only when the higher priority MX refuses / fails to accept the data connection. With that in mind, I think the spam only hits the lower priority server if the higher priority server rejected the server in the very initial stages of the transaction (which would probably be connect & helo).

Fred

12-14-2005, 11:37 AM

no, the spammer really choose to go directly into the lowest priority mx, the secondary mx... Secondary mx doesn't have a spam scanner... or do have a spam scanner less often then a primary mx ...

So, spammers scripts look for your lowest priority mx listed in your dns and connect to it... Your secondary mx is always up even if the primary is up, it will accept the mails...

ozgreg

12-14-2005, 05:41 PM

Anyone noticed how you cannot DELETE spam out of your quarantine when accessing the quarantine area via the quarantine link in the report..

Charles, anyway to get this fixed ASAP??

charles

12-14-2005, 06:41 PM

nadzri

12-14-2005, 06:44 PM

1) I can't find the quarantine lifespan option. Is there actually one?
2) Is there a way to set different emails to send digest reports to for different domains?
3) The digest reports seem to be sent to a few email addresses e.g. webmaster@ , admin@ . Are they sent to email addresses that have spam quarantined for them?

ozgreg, are you talking about emailed digest reports?

ozgreg

12-14-2005, 06:59 PM

Yeah I gave them that feedback a while ago, but I don't know if it will get changed. The spam will get cleaned up at some point, and if you set your notifications to only show new ones, it's not really a limitation.

charles

Yeah you got to set the purge after x days option and I just changed the report to once a day to stop my mailbox being full of reports and about to add all my forwards as report alias's to stop getting multiple reports etc..

It would not be too hard to write some php code to strip out the mail addresses out of DA however I somehow doubt Mailfoundry has a API to automatically update it's DB..

Can you check if they do have an API to update mail settings anyway Charles??

charles

12-14-2005, 07:04 PM

1) I can't find the quarantine lifespan option. Is there actually one?

There is a system wide setting at 5 days. I don't see it per user though.

2) Is there a way to set different emails to send digest reports to for different domains?

Not that I know of.

3) The digest reports seem to be sent to a few email addresses e.g. webmaster@ , admin@ . Are they sent to email addresses that have spam quarantined for them?

ozgreg, are you talking about emailed digest reports?
They get sent to the addresses that they were destined for. ozgreg said he figured out a way to send them to one address earlier in this thread.

charles

charles

12-14-2005, 07:11 PM

Can you check if they do have an API to update mail settings anyway Charles??

No API sorry.

charles

ozgreg

12-14-2005, 07:47 PM

No API sorry.

charles

I figured as much but it was worth the Q anyway...

Charlie

12-14-2005, 10:08 PM

Its handy to know that the quarantined emails die after 5 days, I have been inspecting and emptying every few days.

This reference "The life span of messages in the quarantine, digest frequency, and other quarantine options can be set in the Quarantine Settings Interface."
leads me to believe that life span can be set, but the option is not actually in the Quarantine Settings Interface, at least I don't see it, maybe a future feature.

HEY OZGREG Where did you find "Yeah you got to set the purge after x days option "?????

----------------------------------------------------------------------------------------------

In the same Quarantine Settings Interface you can find the Digest Redirections. You can use this to send all your digests to one email address.

------------------------------------------------------------------------------------------------
I would really like to see the date/time received of each email in Quarantine without clicking details for each one.
-----------------------------------------------------------------------------------------------

Not counting mail that bypassed Mailfoundry because of the MX priority issues - - -2458 messages blocked so far and not one "Good " email tagged. 334 passed the scanning, of those around 150 were "bad" emails through that Mailscanner/Spam Assassin picked up. At this point it is a very good "Preprocessor", but not quite good enough for the sole defense. 4 different viruses for a total of 7 were blocked. No viruses that went through Mailfoundry scanning made it alive.

I hope this is the sort of feed back you are looking for. If not just tell me.

charles

12-14-2005, 10:23 PM

The purging frequency is a global server option. I logged in as a user and couldn't see the option ozgreg described (not saying it's not there :0 ).

This is the kind of feedback were looking for. Were not trying to sugar coat the deficiencies. At this point either it will be "good enough" as a reliable and safe (ie no false positives) preprocessor for people, or it wont. So everyone's opinion is valued and it's ok if you don't like it :)

No-one seems to want to put a price on it though. If you were to use it, what would you pay for it a month? Something like 10/100 domains or something, or you tell me?

charles

Charlie

12-14-2005, 11:05 PM

$1 per month per domain , otherwise a Power2 VPS would solve my problems and keep everything running in one mailscanning/tracking system, since mailfoundry wouldn't work for ALL my scanning/recordkeeping needs.

This figure is subject to change without notice as I use the system more and gather more info. :-)

ozgreg

12-15-2005, 12:00 AM

The purging frequency is a global server option. I logged in as a user and couldn't see the option ozgreg described (not saying it's not there :0 ).

MessageIQ Settings -> Quarantine Options -> Digest Redirections

ozgreg

12-15-2005, 12:04 AM

ozgreg

12-15-2005, 12:15 AM

HEY OZGREG Where did you find "Yeah you got to set the purge after x days option "?????

Yeah damn good question I could have sworn I saw this before but I soo cannot find it again :-(

The documentation states "The life span of messages in the quarantine, digest frequency, and other quarantine options can be set in the Quarantine Settings Interface."

But I cannot find it.. I could have sworn that I set this before although...

TomK

12-15-2005, 12:49 AM

Charles, pricing remains difficult for me because this service has so far proven to be only a partial filter as we have had to turn spamd back on for our domains.

Does this reduce the amount of spam we get... yes.. Is this solution complete.. no. Could we live without this solution and instead have spamd and clamAV on our machines instead although these options have a "cost" in machine IO.. yes

If mailfoundry scored spam (which seems to be the best global solution) then I would be more comfortable paying a premium for it but as this thread has highlighted it is very hard to justify paying more money for a solution that still to me seems incomplete..

To put a figure I would add it into the monthly fee - Spam/AV per account - $4.95/month. I would not do it on a domain / domain, rather an account level..

Hey Folks,

Great feedback/thread so far, much appreciated. If you have any other suggestions for AV/AS appliances that you think we should be looking at, go ahead and post em here. The one requirement though is that it supports per domain pricing, and not per account/user pricing, like the Barracuda device does, that just makes an ISP or Enterprise solution much to costly for the end users we are looking to target.

The Mailfoundry device is nice because it has some human intelligence to it for spam scoring, and it is a very 'non-technical' appliance, and for the most part, you set-it-and-forget-it without having to train it, tune it, etc.

However it has missed almost all the russian spam I have gotten, and I've been sending them 100-200 mails a day hoping their 'humans' would get on the ball and get this stuff marked, hasn't happened yet.

Postini is a really nice service offering - but again, they charge per user account and not domain. MX Logic seems like another one too, but good luck trying to deal with them - seems they would rather not sell you the product and push you through folks like Tucows that resell their service.

I've tested a few other options personally, and agree with some of the other comments in this thread - there is no one device that works today, you need a multi-layered approach to catching all this 'crap'. SA marked so much of my stuff as junk it became annoying, the AS tools in Thunderbird keep marking some emails as junk, even after a dozen or more times me telling it that an email is NOT spam.

Even though the MF for me has not caught all the spam, the good part for me is that it has not marked anything spam that it should not have, and that is with about 5k emails that hit my email client per day (personal, lists, tickets, sales, etc). Now that I can deal with, I'd rather it miss some then falsely mark ANY.

So, if you have any URL's for other appliances, post em here, we're open to testing others.

tjk

ozgreg

12-15-2005, 01:40 AM

Domain pricing for us?? Personally I would find per domain pricing a deterrent towards your offering. I do not resell my VPS thus all the domains (6 of them when finished) are either owned by me or hosted by myself with my permission at my cost. If PowerVPS decided to introduce domain pricing I would have to pay for 6 domains, which to me does not represent an optimal pricing structure and I would have to consider what domains to filter thus decide is it really worth paying for a service that only covers part of the incoming spam on some of my domains..

Sorry ****/Charles but I would much prefer per account pricing for something like this...

charles

12-15-2005, 02:04 AM

I think you are assuming that a 10 domain account would be more than your willing to pay (even if your only going to use 6). But also understand that we can't sell an account for $5/month and have a reseller put 500 domains on it.

charles

skyblu

12-15-2005, 05:03 PM

You make every effort 'behind the scenes' to provide us with a strong base of security and protection. I want to say a BIG thank you for that. :)

Now, for a recommendation, I've been reading up on Grisoft's AVG Antivirus. Yes, there's versons for both Linux and Windows. There are alot ove raves and is said to be a strong program.

http://www.grisoft.com/doc/1

EDIT: They have a trial also Trial (http://www.grisoft.com/doc/trial/lng/us/tpl/tpl01)

ozgreg

12-15-2005, 06:19 PM

StingRay

12-15-2005, 11:48 PM

Or charge per VPS? A Power-1 can only handle a certain amount of clients., Power-2 more, etc.
However if YOU are being charged by domain, then it would only work if the price was either low enough that the average theoretical max per VPS was still profitable or charge per domain.

nadzri

12-16-2005, 02:14 AM

From my understanding of what **** said, per account meant "per email account/user" (not per vps account) in which case per domain is cheaper. I think per domain is quite fair in the sense that you pay more if you use more.

On the flip side, when the cost increases as the number of domains increases, for me it becomes mailfoundry vs another vps dedicated to filter email. I mean, I'm beginning to like MF (but I'm still in an early stage), and I know there's redundancy and DefTech running the service but I would prefer if it is not going to cost me so much so as to drive me into thinking abt another solution later on.

ozgreg

12-18-2005, 06:22 PM

Charles,

I have sent you a PM with a few issues, sorry mate :-(

Well the war with the spammers have taken a new turn as they have gone back to directly mailing my mail.domain.com server thus bypassing mailfoundry again which is a neat trick because mail.domain.com is not in my domains mx records. Not sure how I am going to fix this issue.. Anyone got any ideas on how to block this type of spam...

charles

12-18-2005, 06:56 PM

ozgreg

12-18-2005, 07:21 PM

Thanks Greg. Please send these to support@powervps.com in the future - it's the only way we can track them.

The only way I can think of you stopping this completely is to publish just the MF, and then only allow connections to your mail server from the MF (or MF(s) in the future).

charles

Yeah I thought about something like this, only allowing SMTP port connection 25 from localhost or mailfoundry then using port 587 for my SMTP traffic. No idea if this is possible but that would represent the best solution so far...

nadzri

12-18-2005, 07:43 PM

I'm having the same problem as ozgreg. I've published MF as my sole mx but a few spam still gets delivered directly to my mail server. How are they accomplishing this, especially when my www and mail are on different IPs and different machines? Are they mining the whois db and emailing all IPs?

On the feedback side, would it be possible (in the future, I know it's not now) to be able to set the digest to be delivered more than once a day? (But not hourly) It might be useful to get a report at the start of the day, and then maybe near closing time so that if any valid email got caught it could be dealt with today rather than tomorrow.

Also, a few of the virus alerts by MF has been flagged as spam! :0

In the digest report's action, I suggest putting another one or combined with a Release - "Whitelist this sender".

ozgreg

12-19-2005, 12:10 AM

Nadzri,

I just made a series of changes to block this.. (Which I be happy to post if you want).. Basically I changed my exim.conf to allow authenticated SMTP sessions on port 587 then configured APF to block all but internal / MF connections on port 25..

The result is only my VPS or MF can connect to port 25 now.. No more direct sending from spammers ;-)

web007

12-19-2005, 09:12 AM

First of all very important thread.

My few points:

1. We'll be interested in outsourcing e-mail management solution, to reduce the server
load and email maintenance

2. Postini email solution is very good and reliable. We used it in the past.
This is true that Postini solution works on per user account basis, but its possible
to make this user account "catchall account" for all email accounts of a specific domain.
In this way all messages go to catchall account on Postini server and after being filtered
they go to each email account of this domain. We used Postini solution this way for entire
domain.

We'll be interested in this kind of solution for 1$-1.5$ per user/domain.
Of course other options of this kind will be welcome as well!

Carlos Camacho

12-20-2005, 05:47 AM

I just made a series of changes to block this.. (Which I be happy to post if you want).. Basically I changed my exim.conf to allow authenticated SMTP sessions on port 587 then configured APF to block all but internal / MF connections on port 25..

The result is only my VPS or MF can connect to port 25 now.. No more direct sending from spammers ;-)
You think you could write up a longer/detailed HOW-TO on this? Sounds nice. :D

ozgreg

12-20-2005, 07:47 AM

Ok I will post a how to for you in a few hours (bed first) ;-)

ozgreg

12-20-2005, 06:34 PM

HOWTO limit connections to Port 25 / Allow SMTP on port 587

Purpose of this HOWTO is to limit the connection of Port 25 to a selected range of IP addresses, instead allowing authenticated SMTP connections on port 587

Allowing authenticated SMTP connections to port 587

edit your /etc/exim.conf

--------------------------------
look for the following..
--------------------------------

system_filter = /etc/system_filter.exim

--------------------------------
add after
--------------------------------

# allow incoming email submission port 587

daemon_smtp_ports = 25 : 587

--------------------------------
look for the following..
--------------------------------

################################################## ####################
# ACLs #
################################################## ####################

begin acl

# ACL that is used after the RCPT command
check_recipient:

# to block certain wellknown exploits, Deny for local domains if
# local parts begin with a dot or contain @ % ! / |
deny domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]

-------------------------------
add after
-------------------------------

# to restrict port 587 to authenticated users only
# see also daemon_smtp_ports above
accept hosts = +auth_relay_hosts
condition = ${if eq {$interface_port}{587} {yes}{no}}
endpass
message = relay not permitted, authentication required
authenticated = *

save exim.conf

Allow port 587 in your firewall and limit connections to port 25

edit your /etc/apf/conf.apf

--------------------------------
look for the following
--------------------------------

# Common ingress (inbound) TCP ports

add port 587 and remove port 25 from the line IG_TCP_CPORTS=

save conf.apf

edit your /etc/apf/allow_host.rules

--------------------------------
Append the following line (which will allow incoming port 25 connections from Mailfoundry) (also see note*)
--------------------------------

tcp:in:d=25:s=205.234.111.114

save allow_host.rules

then restart exim and restart apf

service apf restart
service exim restart

NOTE: I would also strongly recommend you add all your site IP addresses as well in the format of
tcp:in:d=25:s=xxx.xxx.xxx.xxx technically you should not need this but in some cases certain applications try to connect to SMTP externally so we will allow them just incase..

ozgreg

12-20-2005, 08:01 PM

Charles,

Can you also please put in a request to add the subject to the Quarantine Queue report, it is very hard to work out if it is not spam just from to / from email addresses

Thanks :-)

charles

12-20-2005, 08:14 PM

Done! Thanks for the feedback.

ozgreg

12-20-2005, 10:53 PM

Done! Thanks for the feedback.

No worries, I know you be bored without me.. Right ;-)

nadzri

01-06-2006, 10:58 PM

I am getting to really like this service. It's just set and forget now. I'm still getting spam but it's only about 5 to 10 a day. I'm also using MF as my sole MX and so far it's been reliable. The emails that were skipping MF and going straight to my mail server have stopped, I think it was a case of dns caching.

It's interesting to note is that it has taken some processing load off my vps. One of sites I host uses email primarily and after I put them under Mailfoundry, my server load has gone down and my main site has become more responsive during peak hours. Well, either that or it's because I've upgraded my cms (probably not this), or they've switched me to another node. :) This will allow me to host a few more sites if I need to, reliably, which is why I got a vps in the first place.

I'd like to ask for (1) A more flexible digest delivery setting. I'd like to get reports twice a day, at the start and close of business.

Also, I have yet to get a false positive, so I don't know how "Release and Report as Ham" really works, and how quick and effective. If it is efficient, fine, otherwise, another option in the digest - "Whitelist this sender" - I think can be useful.

As for pricing, hmmm.... I can see the value of this service, especially if email is quite heavily utilised. I'm not sure about numbers yet. I host less than 10 domains (maybe up to 15 later), and these are all either mine or my friends who contribute to the cost. ozgreg mentioned 'per vps account', Pvps is looking at 'per domain'. Perhaps a middle ground of per vps account with a limit on the number of domains?

Charlie

01-07-2006, 10:39 AM

I have completed my testing.
For approx 30 days 12,000 messages were scanned
75% were blocked as spam
8% as viruses
I did a lot of checking and as far as could tell NO good emails were tagged as spam
of the 17% that got through, Spam Assassin found over half to be Spam
No viruses got through

Comparing to Mailscanner
MailFoundry is MUCH easier to set up
MailFoundry No false tagging with the default set up
Mailscanner is much more configurable and with some work picks up 10% more spam
Mailscanner works pretty well on tagging Phishing and Dangerous content
Combined with MailWatch, Mailscanner has lots more reporting ability

MailFoundry really takes a load off your server, even if you leave spam assassin on to handle what does get through.
MailScanner is a resource pig. Lots of processes, lots of load, lots of kernal memory.

My final decision
I stuck with Mailscanner/Mailwatch, but did upgrade to a Power2 which seems to be handling resources fine. A Power 1 couldn't do it. My niche is advance reliable email handling and Mailscanner is a great tool for that. There is very little it won't do but it does require a fair amount of work and tweaking initially.

I am still a little curious about pricing. I could run my 40 accounts on a Power1 with Mailfoundry. Going to a Power2 cost me $40 more per month in order to get Mailscanner to work, so in theory to be cost effective (For Me) Mailfoundry would have to be less than $40 per month for 40 accounts (domains)

charles

01-07-2006, 10:56 AM

Very valuable feedback from both of you, thanks!

orenatsmart

01-10-2006, 09:26 PM

Charles,
I have recently moved to PowerVPS and the deciding factor in leaving my old host was an over-aggressive anti-spam/antivirus system that:
1. Yealding too many false positive
2. Offered no end-user feedback
3. Offered no end-user configuration

I am still in the process of migrating accounts to my VPS but added my personal domain to the test today. Wow! So far there's not much to gripe about and much to enjoy.

One of the biggest problems I had on my old host was email from Yahoo Groups being blocked. I've whitelisted yahoogroups.com for my domain and this should ensure I don't have the same problem here.

The only change I would suggest (based on less than 24-hours of use...) would be to include the email subject in the list of quantines messages. I use SpamBayes locally on my laptop and sort all spam by subject and find that I can more quickly scan messages when they are softed this way.

As far as pricing - I don't think I'd have a problem with a per-domain pricing scheme. It's a value added addition to my customers - those that want it use it...

Oren
oren at sphost dot biz

nadzri

01-11-2006, 12:27 AM

The only change I would suggest (based on less than 24-hours of use...) would be to include the email subject in the list of quantines messages. Email subject is included, at least for me.

jechilt

01-13-2006, 12:39 AM

ozgreg

01-13-2006, 08:27 AM

Greetings,

I followed your instructions and I was unable to send via port 25 from my mail clients. We ended up adding port 25 back to the apf.conf file.

tks.
john

Scratches head.. that was kind of the entire idea of the How-to, that is to restrict port 25 access to just your VPS machine and instead use port 587 to send mail from your mail clients...

charles

01-13-2006, 10:04 AM

Oren, thanks for the feedback.

charles

jechilt

01-25-2006, 09:12 PM

Monitoring Status:

We are 12 days into our testing and have the following details:

7 domains being monitored
4561 Total Messages
2023 Allowed = 44.35%
2538 Blocked = 55.65%
21 Viruses = ~1.25%
-- Worm.SomeFool.Gen-1 = 16 = 69.67%
--HTML.Phishing.Bank-1 = 6 = 26.09
--FunLove.4099 = 1 = 4.35%

We have been monitoring the logs and the users are providing us any SPAM messages that are still getting through. We have not seen any VALID messages blocked yet. That is a great thing. We have had around 5 messages in total that got through the MailFoundry filter that was SPAM which we forwarded to defenderhosting.

Although we have SPAM Assassin running, several of our domains were being bombarded with SPAM messages. The users are very happy as MailFoundry appears to be doing a great job. Also, the Quarantine Digest email sent out to the user is proving to be a nice bonus. The Quarantine Digest is very well liked.

We have also noticed that MailFoundry takes a load off the server. If we were to use MailFoundry, we would probably stop SpamAssassin.

We have asked our users what kind of terms they would accept and it appears that most would be willing to pay about 1USD/Month per domain. Anything more and most would balk at it.
We have one domain that has many email accounts. They are in favor of a domain pricing scheme over individual mailboxes.

One thing is certain, the longer this test goes on the harder it will be to go back to SA!

orenatsmart

02-01-2006, 01:42 AM

We are 12 days into our testing and have the following details:

7 domains being monitored
4561 Total Messages
2023 Allowed = 44.35%
2538 Blocked = 55.65%
21 Viruses = ~1.25%
-- Worm.SomeFool.Gen-1 = 16 = 69.67%
--HTML.Phishing.Bank-1 = 6 = 26.09
--FunLove.4099 = 1 = 4.35%

I'm around the same rates - 1 domain for the month of Jan:
Total Messages - 8719
Allowed - 4814 (55%)
Blocked - 3905 (45%)
Virus - 25 (0.3%)

I've had a number of false positives (good mail marked as junk) but have been able to see them in the quarantine lists.

We have asked our users what kind of terms they would accept and it appears that most would be willing to pay about 1USD/Month per domain. Anything more and most would balk at it.
We have one domain that has many email accounts. They are in favor of a domain pricing scheme over individual mailboxes.

One thing is certain, the longer this test goes on the harder it will be to go back to SA!

I'll second the vote of mailfoundy over spamassasin.

Charles - has there been any thought as to pricing? I've moved about half of my domains from my old reseller account with another host onto my VPS and would like to offer enhanced spam and virus filtering. Knowing what the price point is going to (or likely to) be would help me.

Oren

charles

02-01-2006, 07:29 PM

Charles - has there been any thought as to pricing? I've moved about half of my domains from my old reseller account with another host onto my VPS and would like to offer enhanced spam and virus filtering. Knowing what the price point is going to (or likely to) be would help me.

Oren

Here is what we are leaning torwards right now:

$5 minimum per domain, giving up to 5 protected accounts [1]
Additional protected addresses above the first 5 on a domain will be $1.25/address.[2]
We'll offer some kind of reseller discount for high numbers of domains/accounts.

So if you have 5 or less addresses you want protected on a single domain, the cost would be $5/month. If you had 2 domains like this, it would be $10/month. If you had a domain with 10 protected addresses it would be $5+(5*1.25)=$11.25/month.

We feel this is a low enough amount to allow the small guy to have affordable protection, but also protect us from abuse.

Feedback welcomed as always.

charles
1. A domain can have additional valid accounts or even a catch-all address, but only the "protected" addresses will be scanned and billed for. The rest will just pass through.
2. We will track the number of accounts daily and at the end of the month charge for the average over the month if you exceed the base $5/domain.

nadzri

02-02-2006, 01:46 AM

$5 minimum per domain, giving up to 5 protected accounts [1]
Additional protected addresses above the first 5 on a domain will be $1.25/address.[2]
We'll offer some kind of reseller discount for high numbers of domains/accounts.

So if you have 5 or less addresses you want protected on a single domain, the cost would be $5/month. If you had 2 domains like this, it would be $10/month. If you had a domain with 10 protected addresses it would be $5+(5*1.25)=$11.25/month.

We feel this is a low enough amount to allow the small guy to have affordable protection, but also protect us from abuse.

Oooo :eek: I thought the way to go was per-domain, looking at this, it's really more of a per-email pricing.

Looks like I may have to move off :( . It's not an attack on your prices, I just wouldn't be able to afford it, and I doubt the owners of the 2 domains I have that have around 10 addresses each would be willing to pay USD11/mo considering they pay me a nominal USD10/mo (I'm not a reseller, those are friends sharing the cost).

I can see your point though. Quietly, I thought $1/domain was kinda silly, especially if a domain had >10 email boxes.

For those that are willing to pay that much, if you're (DefTech) going the per-email-account route, my suggestion is you just discard the per-domain and give a flat 1st 20 emails USD20 (as an example) so they can be distributed over whatever number of domains.

ozgreg

02-02-2006, 03:24 AM

Sorry Charles but I really feel this kind of pricing is just unrealistic for a service that has known limitations, only catches 85% of the spam (for me). Since I host multiple domains I could simply put at those kind of $ your service would cost me to stepping up a level and installing mailscanner + clamav solution and does have a FAR better anti-spam solution for cheaper $.

I can understand per email addresses if you are a domain reseller but for the rest of us just hosting sites for personal / friends / open source your pricing model is way too expensive.

$10 flat/month would be the top $ I would pay.

TomK

02-02-2006, 10:23 AM

Hey Folks, thanks for the feedback so far!

I just wanted to explain the logic on how we approached the pricing, if anyone cares :)

We basically looked at some of the more popular services, like MXLogic and Postini, and the hundreds of resellers of both of these services. Both of these services are based on a per-account basis (an account being an email address john@somewhere.com for example) - with pricing starting at about $1.50 per month and on volume dropping to $1.25 range.

I've searched and cannot find any quality outsourced offering that does it on a per-domain basis with unlimited accounts, understandbly too.

The other option we looked at was just doing a flat per-account offering, but the man hours of having someone create an invoice, track down open and past due invoices, and do support and provisioning would actually end up costing us money in the end, hence the $5/month minimum to get started, less then one drive through session at the Golden Arches!

I do understand the concern about the 85% hit rates and such, we spoke with the vendor yesterday about this, and they have some plans in place to improve upon this, capture the russian spam, etc.

Just FYI, NO outsourced spam tool is a replacement or end-all-be-all tool, I've tried the Barracuda, built in tools on Exchange, The Bat, Thunderbird, etc, and none of them were much better stand alone then the others, hence having a multiple approach to catching all the junk mail, such as SA, Clam, and using a tool like MF, Barracuda, MXLogic, etc. Much like antivirus and adware, one tool just doesn't seem to be good enough these days, unfortunately.

We welcome more feedback of course, but I can say with confidence we can't offer a flat rate per domain with unlimited accounts/volume, or just a single account at $1.xx per month, both of those are money losers alone.

orenatsmart

02-02-2006, 06:16 PM

Here is what we are leaning torwards right now:

$5 minimum per domain, giving up to 5 protected accounts [1]
Additional protected addresses above the first 5 on a domain will be $1.25/address.[2]
We'll offer some kind of reseller discount for high numbers of domains/accounts.

Would you be open to the thought of a reseller paying a higher initial price - say $25 for 25 addresses but being able to spread that number across different domains? So, for example, I could use 5 for customer A, 10 for customer B, and 10 for customer C.

1. A domain can have additional valid accounts or even a catch-all address, but only the "protected" addresses will be scanned and billed for. The rest will just pass through.

Would honeypot addresses count as billable? If not, would email to them be allowed through or would it be blocked?

Oren

ozgreg

02-03-2006, 05:50 AM

Thanks **** for your reply and if you do not mind I am still struggling with your pricing model. To my understanding, Mailfoundry is a hardware / software based machine with an ongoing maintenance fee. Each unit is designed to handle x number of users, and the maintenance fee is global fee per machine.

Thus I cannot understand why we keep on going back to per email address fee's which by my quick sums on the most basic machine which supports 2,500 users @ 1.50 per user earning, $45K year against the cost of the hardware which is $2K + $700K ongoing..

To me this is a marketing goldmine to you, for $10/month add anti-spam filtering to your account. this would set your offering above the rest of the crowd which are around your price range anyway.

Sorry Tom but per email address is too expensive and it is going to be a nightmare to admin, the vendor has NO API's thus it will require a support request to do any account admin maintenance VS having it as part of the global account offering which only requires the initial setup.

I am pushing hard on this topic because I can justify a flat $10 a month but $1.50 per EMAIL account is just way way over the top...

nadzri

02-03-2006, 07:28 AM

ozgreg, are you talking about $10/mo for a vps account, or per domain?

If it's per vps account then although as much as I'd like it too, I don't think it makes sense. Resources are finite and then how do you control the number of users? How would they differentiate betwen resellers and end users like us (hosting our own sites)? In the end, I wouldn't want the machine to be so packed that emails get delayed and so on.

Also, more money can lead to redundancy = hopefully, even better/more reliable service.

However, if $10/mo is somehow doable, maybe by limiting the number of domains or number of users (with extra $ for additions), I'm all for it. After all, for me as an end user, I don't have a whole lot of domains (around 10) and email users (around 50).
:)

ozgreg

02-03-2006, 07:54 AM

$10 a Month Flat fee (per vps account) with a limit on domains would be very reasonable to me and very doable under the current software..

charles

02-03-2006, 10:51 AM

$10 a Month Flat fee (per vps account) with a limit on domains would be very reasonable to me and very doable under the current software..

Greg, I think you analysis of the revenue here is waaaay off, but I'm going to ignore that for now as its not productive or particularily relevent.

Please tell me what limits you would find acceptable in this scenario. How many domains and/or how many accounts do you think you should have for $10/month?

charles

ozgreg

02-03-2006, 07:15 PM

TomK

02-03-2006, 07:23 PM

I do not believe it is domains that is the issue, it is the number of accounts (email addresses) that is the true limitation and to that end I propose 50 email addresses

From the website Mailfoundry 2100 can support 2500 email addresses thus for say $10 the account gets 50 email addresses.

So for each 2100 you could have a maximum of 50 VPS accounts (2500 email addresses) @ $10/month (or $120 a year) roughly $6000 a box / year or $1200 a month

These are really powerful boxes the higher ended units can handle so much more giving you much better ROI's.
You are totally forgetting about having redundant boxes when they release clustering, the rack space, power, ethernet traffic, man hours that go into support, and most importantly there isn't one outsourced provider doing it that way.

I'm all about being fair and such, but when the market is charging $1 to $2 per EMAIL ACCOUNT, there is a reason for that typically.

ozgreg

02-03-2006, 10:49 PM

You are totally forgetting about having redundant boxes when they release clustering, the rack space, power, ethernet traffic, man hours that go into support, and most importantly there isn't one outsourced provider doing it that way.

I'm all about being fair and such, but when the market is charging $1 to $2 per EMAIL ACCOUNT, there is a reason for that typically.

Tom,

I have no way to judge the costs of those, all I can do is a revenue vs cost of replacing the box which has a ROI of less than 3 months.

I am just pointing out what $ I feel I would spend, as for the the other providers, all I can point out is that email filtering would be for them a major revenue stream and as such I would want to charge per email account as well, the question is does powerVPS want this to be a major revenue stream or a way of value adding to your VPS accounts to make you a clear market leader.

I am not trying to be difficult here I am just pointing out for me (and other posters so far) $10 is the maximum we would spend, it is not like we do not have software based spam filtering to fall back on if so desired.

TomK

02-05-2006, 01:18 PM

ozgreg,

You aren't being difficult at all, and I certainly appreciate the discussion!

You are correct, we are not looking for this to be a major/replacement revenue stream, rather a value-add on to our existing offerings.

That being said, the pricing still has to reflect value, including competitive analysis, true cost of providing the service, etc. We truly don't know if the box can hit the #'s they recommend, 1 or 2 heavy users can destroy any model.

The per account option is something we spent some time trying to price out. Unfortunately, without API support (being actively developed), it is a very time consuming process to create X number of accounts across X domains.

One of the other challenges is coming up with a pricing model that covers both types of customers - those that want to use it for internal accounts and don't run/resell hosting and may need one or two domains with 1-10 accounts, and then those that are hosting companies and want to offer it to their hundreds of customers as an option with dozens of domains and 100's of potential accounts.

Suggestions?

ozgreg

02-06-2006, 04:29 AM

One of the other challenges is coming up with a pricing model that covers both types of customers - those that want to use it for internal accounts and don't run/resell hosting and may need one or two domains with 1-10 accounts, and then those that are hosting companies and want to offer it to their hundreds of customers as an option with dozens of domains and 100's of potential accounts.

Suggestions?

Hiya Tom,

You are right about the lack of real numbers, although the vendor lists 2500 email address max for the basic box just how real world are those numbers, I notice the vendor does not actually list any real world throughput which to me is a heck of a lot more meaningful in these types of calculations, you might have 2500 email address but with a maximum throughput of 200 emails a minute for example which is going to limit just how many people can you put on one account.

I been giving a lot of though to what is going to be a fair pricing for you and wondered have you considered what exactly is an email address? is it a pop email address, or is it a SMTP email address which would be pop + forward because that is really going to considerably add to the number of email accounts..

The fairest pricing model to me would be an allocation of X email address as a "block" (See Note) as the number of domains is meaningless because it is the email addresses that represent a limit not domains..

The Email Filtering block could be purchased maybe via the clientexec interface.. something like this..

* VPS Package - $x Month
* Enhanced support - $10 month
* Initial Email Filtering - $10 Month / 50 Email address
* Additional Email Filtering Block - $10 Month for 20 Email Addresses (much higher rate)

This way support is kept out of the loop, thus reducing your support load to handing issues within MailFoundry (after the API's are developed that is)

As you can gather, I am keen on finding the middle ground between my emotional price point of $10 a month and PowerVPS understandable requirement to make a buck..

Note: When thinking about the email "Block" concept, I have some concerns with MailFoundry along the lines of does it actually support the concept of a user account having a finite number of email address (which seems really doubtful) as I cannot see any indication that MailFoundry supports this.

TomK

02-06-2006, 12:38 PM

charles

02-06-2006, 03:51 PM

Note: When thinking about the email "Block" concept, I have some concerns with MailFoundry along the lines of does it actually support the concept of a user account having a finite number of email address (which seems really doubtful) as I cannot see any indication that MailFoundry supports this.

On this note it's worth explaining were making a couple of assuptions here.

1. We'll provide an interface for you to add domains (most lilkey outside of MF)

2. We cannot restrict the number of accounts, so we'll be running a monthly report and billing for overage. We'll provide very clear instructions how to setup domains and accounts so that you only get billed for the addresses you want protected (in other works you can do the current lazy auto discover config many use which would cause charges if you got a dictionary attack say.

hth
charles

ozgreg

02-06-2006, 05:41 PM

Tom / Charles,

What is an email address from a Mailfoundry point of view, I presume a valid SMTP address which would be either a forwarded email or a pop email account..

charles

02-06-2006, 06:26 PM

Tom / Charles,

What is an email address from a Mailfoundry point of view, I presume a valid SMTP address which would be either a forwarded email or a pop email account..

The mail foundry doesn't care if its pop or imap or forwarded.

The mailfoundry has to process *ALL* email for a domain. What it does with it depends on how it's classified. An email address is anything@anydomain.

1. Billable/Protected. You configure it to scan this address for either spam or viruses or both, and apply rules etc.
2. Non-billable/Unportected. Configured to ignore these and just send them on the to the destination SMTP server without any processing. It will of course hold email if your SMTP server is down etc.

For our discussion, an email address is #1. anything@anydomain that is configured to scan/protect.

hth
charles

ozgreg

02-07-2006, 02:03 AM

$5/month for 5 accounts - no longer restricted to one domain, can be spread across 5 domains if you wish.

$10/month for 20 accounts - no longer restricted to one domain, can be spread across 10 domains if you wish.

Add-on pack to either plan would be $10/month for 20 additional accounts.

Thoughts?

I think this pretty fair, against current market rates this is very good value :)

ozgreg

02-07-2006, 02:07 AM

I have noticed a marked increase in a new type of spam, generally the subject lines are like this Subject: Re: I news 4231 (see below) with valid looking SMTP addresses, Basically Mailfoundry fails to mark these as spam :( and sadly I am getting an increasing number of these "new" types of spam.

Anyone else getting these as well??

Incoming Mail Headers...

Received: From 200-207-59-167.dsl.telesp.net.br (200.207.59.167) by mailfoundry1.defenderhosting.com (MAILFOUNDRY) for thezone@cyberemail.org; Mon, 6 Feb 2006 14:31:54 -0000 (GMT)
Message-ID: <000001c62b29$ff9339d0$56f5a8c0@eyeful>
Reply-To: "Jussi Whelpley" <whelpleyojussi@tn-prop.com>
From: "Jussi Whelpley" <whelpleyojussi@tn-prop.com>
To: "Kwesi Sampley" <postmaster@cyberemail.org>
Subject: Re: I news 4231
Date: Mon, 6 Feb 2006 09:31:20 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C62B00.16BD31D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

ozgreg

02-07-2006, 03:13 AM

Charles/Tom,

I was hoping (wondering and really hoping) you would not consider the postmaster@ and webmaster@ email address as part of the spam filtering quota because these two address are really required and common targets for SPAM emails..

:-)

nadzri

02-07-2006, 06:51 AM

The prices do seem fair and reasonable.

Thanks for listening to ozgreg ;) :D

charles

02-07-2006, 10:09 AM

orenatsmart

02-07-2006, 04:28 PM

Here is a new model we came up with this morning, which I think (hope) works much better for both the 'smaller' user, as well as a reseller/qty user.

$5/month for 5 accounts - no longer restricted to one domain, can be spread across 5 domains if you wish.

$10/month for 20 accounts - no longer restricted to one domain, can be spread across 10 domains if you wish.

Add-on pack to either plan would be $10/month for 20 additional accounts.

Thoughts?

The fact that as a reseller I can purchase 20-address blocks at $0.50/address where the "list price" is $1.00/address and I can share the block across domains makes this a winner for me. I have a couple of accounts that I wanted to add to the mailfoundry but was holding off until pricing was set.

1. Billable/Protected. You configure it to scan this address for either spam or viruses or both, and apply rules etc.
2. Non-billable/Unportected. Configured to ignore these and just send them on the to the destination SMTP server without any processing. It will of course hold email if your SMTP server is down etc.

For our discussion, an email address is #1. anything@anydomain that is configured to scan/protect.

I asked a couple days ago and haven't seen an answer. In the SMTP settings there is the ability to flag specific addresses as honeypots - either explicit spamtraps or outdated addresses that are no longer valid and just receive spam. Will these addresses count as billable?

Oren

jechilt

02-14-2006, 11:28 AM

Yes, we have been getting pounded with these messages as of late. We just forward them to the defender address for them to do whatever it is they do...

I have noticed a marked increase in a new type of spam, generally the subject lines are like this Subject: Re: I news 4231 (see below) with valid looking SMTP addresses, Basically Mailfoundry fails to mark these as spam :( and sadly I am getting an increasing number of these "new" types of spam.

Anyone else getting these as well??

Incoming Mail Headers...

Received: From 200-207-59-167.dsl.telesp.net.br (200.207.59.167) by mailfoundry1.defenderhosting.com (MAILFOUNDRY) for thezone@cyberemail.org; Mon, 6 Feb 2006 14:31:54 -0000 (GMT)
Message-ID: <000001c62b29$ff9339d0$56f5a8c0@eyeful>
Reply-To: "Jussi Whelpley" <whelpleyojussi@tn-prop.com>
From: "Jussi Whelpley" <whelpleyojussi@tn-prop.com>
To: "Kwesi Sampley" <postmaster@cyberemail.org>
Subject: Re: I news 4231
Date: Mon, 6 Feb 2006 09:31:20 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C62B00.16BD31D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

jechilt

02-14-2006, 11:51 AM

Here are our stats for Jan and Feb (thus far)

January
Domains: 7
Total Messages: 7462
Allowed Messages: 3261
Allowed: 43.7%
Blocked Messages: 4201
Blocked: 56.30

February (to 14 Feb)
Domains: 7
Total Messages: 6357
Allowed Messages: 3261
Allowed: 41.54
Blocked Messages: 3716
Blocked: 58.46

With exception to the latest spam messages getting through, MF appears to be working ok. We found that coupling it with SpamAssassin, we have much less Spam coming in.

We do ZERO reselling and work mostly with military folks. Getting an extra dollar out of these guys (me included) is like getting blood from a turnip. Some people are just "tight", others have such a tight budget that they don't have much more to spend on additional services. So, I guess when dealing with the common Joe, they will be likely to spend more for the service. Unfortunately, we don't deal with many "Joe" users.

I am probably my own worst enemy when it comes to email accounts. To help us manage our accounts, we have mulitple email accounts. For example, our support email addresses uses a forward email address for technician responses. When the technician responds, the system picks up the message and adds it to the trouble ticket system for us so the tech does not have to always log into our control panel to answer a trouble ticket. So, for our trouble ticket system, we use 3 accounts and have several forwards for the tech accounts. We have 2 admin accounts, a billing account, sales, purchasing, affiliate, forum, spam, paypal, 2c0, and so on. According to the proposed billing structure, I would paying for about 20 accounts. This does not take into consideration my own personal domain and the email accounts for it. (I use IMAP and it makes managing all the accounts much easier for me..that is why I have so many accounts)
We are not a big operation and make just a little more than what we pay out so this is a huge stretch for me.
We will send an email to our 7 domain testers and see how they feel about the new price suggestion. As much as we would like to pay the amount you are wanting, the "per domain" approach is most lucrative for us.
Not to get much into the revenue issues since it appears to have been hammered on quite a bit, I have to say that though the profits to be made for defenderhosting is not of our concern, it does play a valid role in the consideration of what we are going to pay. If you take the oil companies for example, they made billions from the catastrophe of Hurricane Katrina. Prices for fuel in the US were 3 to 4 dollars per gallon. We all paid it but I am sure none of us were happy about it. To take it a step further, most were furious when they learned how much the oil companies made during that quarter. What did we get in exchange for their profits? Nothing!
Point is that when it appears that a company has a gold mine for cash revenue, it becomes a factor.
As I read the posts from OZGREG, I felt he was addressing the same issues I have.

Before defender hosting started testing MF, we have been looking high and low for a solution to help bring spam levels down. MF is not the end all for effective AntiVirus and AntiSpam processing but it does seem to make it more convenient.

We will post the results of pricing once we get some feedback from our users.

Thanks!

jechilt

02-14-2006, 01:23 PM

A couple of questions that have been coming up:

1. If a user wants to change their email account (example: joe@domain.com to joey@domain.com), will it be possible?
I am guessing we would just add that account and delete the other account?

2. If the service is going to be by email account, will we still have all mail funnel through the MF server?
Explained: Domain has 5 email accounts. User signs up for 3 email accounts. To ensure all email for the five accounts are going through the MF server, we set the MX record accordingly. The two accounts that are not signed up for service, are they simply passed through MF without being scanned?
If all mail funnels through MF, question answered. If accounts not signed up do not go through the MF server, how do we ensure the signed up accounts go through the MF server? This is assuming we would have to have multiple MX records???

Robert

02-14-2006, 01:59 PM

1) Sure. You would do just that. Remove the old address and add the new one. There is no extra charge to do this.

2) All mail for the domain will funnel through the MF. However only those single addresses specifically marked to protect will be actually filtered. The rest will be directed to the destination mail server.

jechilt

02-14-2006, 05:14 PM

How long until you know what the final pricing structure is going to be?

How long until the billing process will start for MF services?

1) Sure. You would do just that. Remove the old address and add the new one. There is no extra charge to do this.

2) All mail for the domain will funnel through the MF. However only those single addresses specifically marked to protect will be actually filtered. The rest will be directed to the destination mail server.

nadzri

02-15-2006, 04:54 AM

How long until you know what the final pricing structure is going to be?

How long until the billing process will start for MF services?
Hopefully, two to three years' time. :D ;)

charles

02-15-2006, 10:41 AM

Hopefully, two to three years' time. :D ;)

Stop rushing us or you'll have to start paying!

Seriously, we don't feel comfortable charging for it until we have clustering support (for true redundancy), which is expected soon (but no exact ETA from the vendor).

charles

jechilt

02-15-2006, 11:43 AM

Have you considered early bird specials for your 'beta testers'?

I was pleasantly suprised to see about 60% of our testers are willing to pay for the service. :)

Do you have a system set up yet for us to take a look at or play with for setting up the accounts we want to use? Currently, you are allowing scans to be done by domain. Since that will change to a 'per account' basis, it would be great to see the interface.
On the same note, per user....will we have the opportunity to set up the MF Quarantine digest per account also?

Stop rushing us or you'll have to start paying!

Seriously, we don't feel comfortable charging for it until we have clustering support (for true redundancy), which is expected soon (but no exact ETA from the vendor).

charles

orenatsmart

02-15-2006, 11:15 PM

Seriously, we don't feel comfortable charging for it until we have clustering support (for true redundancy), which is expected soon (but no exact ETA from the vendor).

Fair enough. Are you still accepting new domains for fitering?

Also, as a reseller will my customers be able to log in and see their domain and will I be able to log in and see all of the domains under me?

Oren

Robert

02-21-2006, 10:32 PM

Fair enough. Are you still accepting new domains for fitering?

Also, as a reseller will my customers be able to log in and see their domain and will I be able to log in and see all of the domains under me?

Oren

Sure. Open a support ticket. We'll need to know your username and the domains.

Regarding the reseller interface... the details there are not known yet.

ozgreg

02-22-2006, 03:02 AM

Robert / Charles,

Have we had any new software lately on MF? I suddenly found in the last two weeks my amount of spam that had slowed to a trickle has come back as a flood.. :(

charles

02-22-2006, 05:05 PM

Robert / Charles,

Have we had any new software lately on MF? I suddenly found in the last two weeks my amount of spam that had slowed to a trickle has come back as a flood.. :(

There are no updates pending, but antivirus/antispam updates happen automatically.

The only thing I can suggest is you report the stuff that gets through.

charles

ozgreg

02-22-2006, 10:49 PM

Yep already been sending spam back to spam@mailfoundry.com not that it been doing much :(

netrider

02-23-2006, 01:36 AM

I've forgotten .... how/where do we logon to mailfoundry and check our spam statistics?

charles

02-23-2006, 09:43 AM

I've forgotten .... how/where do we logon to mailfoundry and check our spam statistics?

Email support if you don't recall your login details, but the URL is

http://mailfoundry1.defenderhosting.com/

hth
charles

smoore

03-03-2006, 06:54 PM

Nice update to Mailfoundry, we can see the subject line in the quarantine now.

I've been overall pleased with it so far. The only thing I don't like is that the aggressiveness can't be turned down. I get a lot of different newsletters, and I've had to whitelist just about every one as they were classified as spam. As a newsletter owner myself I really wish spam solutions could be more discriminating. So far I also had two false positives on some personal e-mail, so have to watch the quarantine carefully and then update the whitelist. Despite this I like the load it removes from my VPS, especially as I was constantly getting dictionary attacks.

ozgreg

03-03-2006, 11:59 PM

Had a chance to look at the new software version...

Overview Screen -> Last 12 months by percent is wrong (it is showing figures in months that the machine was not even running in!!!)
I had some serious issue with the Quarantine I could not release emails from prior to the upgrade it seemed that MF had gotten confused and I ended up being forced to do a delete all to clear the Quarantine to clear older spam.
The sum of Quarantine messages is not adding up, I currently have two messages in spam yet the total is showing 1.
It is great to see subject in quarantine thankyou for passing on that request!! :)
Statistics are now adding up (woohoo) I no longer get 86,000 emails a month ;)
Still cannot see anyway to limit how long messages are kept in Quarantine before automatically being purged
Firmware version would be nice with some kind of changelog so we could see what has been changed..

I have also noticed a number of false spam from list addresses from (sourceforge.net) which I been forced to white list. This would be the first time I seen false negatives upto now it been 100%

Sorry to nag here but it would have been nice to read some thing about a new version being installed :)

charles

03-04-2006, 06:05 PM

Had a chance to look at the new software version...

Overview Screen -> Last 12 months by percent is wrong (it is showing figures in months that the machine was not even running in!!!)
I had some serious issue with the Quarantine I could not release emails from prior to the upgrade it seemed that MF had gotten confused and I ended up being forced to do a delete all to clear the Quarantine to clear older spam.
The sum of Quarantine messages is not adding up, I currently have two messages in spam yet the total is showing 1.
It is great to see subject in quarantine thankyou for passing on that request!! :)
Statistics are now adding up (woohoo) I no longer get 86,000 emails a month ;)
Still cannot see anyway to limit how long messages are kept in Quarantine before automatically being purged
Firmware version would be nice with some kind of changelog so we could see what has been changed..

I'll give them this feedback, thanks

I have also noticed a number of false spam from list addresses from (sourceforge.net) which I been forced to white list. This would be the first time I seen false negatives upto now it been 100%

Sorry to nag here but it would have been nice to read some thing about a new version being installed :)
My bad.

http://www.mailfoundry.com/support/?package=release&id=MF2006022800

We are not going to enable the new anti-spam engine for now, so not sure why you are seeing false positives.

charles

ozgreg

03-05-2006, 06:16 PM

Hiya Charles,

Was the new Beta spam engine turned on? Because I am noticing a sharp increase in the number of spam emails avoiding the MF filtering..

I can deal with whitelisting "list" email if it means the 20+ spam emails I am getting a day avoiding the MF filters go away :)

ozgreg

03-05-2006, 06:29 PM

Charles,

I cannot get the release to work at all on "false positive mail" that is trapped in the Quarantine :(

I noticed that you cannot delete spam in the spam Quarantine reports, only release it. I know the system auto purges spam after x days still this is pretty important concept to have.. Can you add it on the wish list.. :)

charles

03-05-2006, 07:01 PM

ozgreg, tell me which email and I'll take a look, and forward to mailfoundry if need be.

The new spam engine wasn't enabled, and I am not sure we will while it's in beta now. We have some dependencies on it now that warrant us being cautious about beta testing it.

I gave them feedback before about deleting quarantined emails. Have you tried the
"Delete All" link for the Quarantine queue under Reports -> Queue Status?

charles

ozgreg

03-05-2006, 07:13 PM

The new spam engine wasn't enabled, and I am not sure we will while it's in beta now. We have some dependencies on it now that warrant us being cautious about beta testing it.

I gave them feedback before about deleting quarantined emails. Have you tried the
"Delete All" link for the Quarantine queue under Reports -> Queue Status?

charles

The Delete ALL got around the old spam being locked in issue (I thought I posted that in my first post).. Although I number of messages in Quarantine does not add up

It appears the individual release is broken..

I understand having dependencies although this is meant to be a beta test ;)

ozgreg

03-05-2006, 07:16 PM

Thinking a little of the release here, I have another suggestion, can MF add the option to release and flag the mail as not spam :)

charles

03-05-2006, 07:35 PM

ozgreg

03-05-2006, 07:50 PM

Have asked them to look at this as I couldn't either, and gave them your feedback. It says it's adding it to a queue to be released so maybe it takes a while (have never released any myself).

It's still beta for you ;)

charles

I never released one before to the new release as well so I cannot tell if this was working or not.. As for adding it to the release queue, maybe something is missing on your end??? But the way it continues to be in my Quarantine queue I am guessing it is broke ;)

Ignores the beta comment :P :P:P

charles

03-06-2006, 11:33 AM

Ok got a response from Mailfoundry.

Re releasing quarantined messages:

"There is a known issue of releasing messages from the quarantine UI. We will have that issue fixed in the next release which we are working on right now. Users can release messages from the digest messages if you have the appliance configured to send those out.

One thing to note, when you release a message, that does not remove it from the quarantine. Messages are only removed by issuing a delete command or by the system automatically removing the messages after the queue lifespan is up."

Regarding the sum of messages:

"The quarantine section of the queue status currently only runs once per hour. This was an oversight by our developers and will be resolved to be more accurate in the next release."

The quarantine lifespan and firmware version are system level only, meaning you as a regular user cannot see them. Keeps having me around useful ;)

charles

charles

03-06-2006, 12:57 PM

Regarding the overview screen showing wrong percentages for the last 12 months, they say

"For the percentage counts, we set the value to 100% ham. It is a limitation of that graph that we have not fixed yet."

hth
charles

ozgreg

03-06-2006, 06:24 PM

Hiya Charles,

"One thing to note, when you release a message, that does not remove it from the quarantine. Messages are only removed by issuing a delete command or by the system automatically removing the messages after the queue lifespan is up."

New item on the wish list, sooo change this feature, why would you want to keep email in a Quarantine queue when it has been released.??

charles

03-06-2006, 06:44 PM

yes, already requested.

jechilt

03-20-2006, 06:53 PM

question about mail foundry services....have there been any instances of delayed mail over the past week.
We have a customer complaining of not getting any mail. Our system shows absolutely nothing out of the ordinary in the logs except for the fact that mail coming in has blocks or "dead time". I am wondering if mail is getting hung up in the mailfoundry system. This was apparent again today at 9am.
I am sure I could have put in a trouble ticket, but I am curious if anyone else is noticing this same symptom?

charles

03-20-2006, 07:39 PM

Yes, this happened today as well as one other time last week. We reported it the first time and they said it's a know bug to be resolved in a patch coming out in the next week or so.

I'll post on the forums when we get the upgrade - they do them over a period of days so I can't predict when.

charles

charles

03-21-2006, 06:38 PM

We'll be upgrading the mailfoundry this evening (a quick rebooot).

http://www.mailfoundry.com/support/?package=release&id=MF2006032000

charles

ozgreg

03-22-2006, 09:15 PM

Hiya Charles,

Can you please confirm the upgrade happened?

Evan

03-22-2006, 11:47 PM

Hiya Charles,

Can you please confirm the upgrade happened?

The upgrade did happen.

dwh-kenl

03-28-2006, 02:53 AM

You need to have control of the DNS for your domains, as you will need to modify your MX record to try this.

does anyone know how can this be done on godaddy please?

ozgreg

04-03-2006, 05:31 AM

Charles,

Any chance we can activate the new beta spam engine? As I am getting more spam than mailfoundry is tagging as spam each day.. :(

charles

04-03-2006, 07:13 PM

Not till the next release at the earliest, sorry.

charles

ozgreg

04-05-2006, 07:37 PM

Hiya Charles,

I understand your reluctance to move over to the new spam detection engine but over the last month, mailfoundry is no longer effective with less than 30% rate in detecting spam. In fact, my default outlook spam filter is more effective in detecting spam right now than Mailfoundry.

I do not know if you want to take this up with Mailfoundry but to me over the last month Mailfoundry has really lost it's effectiveness as a spam filter, I get the same spam day after day and even although I keep on spending the spam to spam@mailfoundry the same spam still gets undetected..

charles

04-05-2006, 11:09 PM

Greg, I'll talk to them. I too see a lot more spam, but if you read the release notes it gives me very little confidence.

If I can just scrounge up the time, we have a baraccuda here to try too. I'd rather throw that in the mix (as a second checker) :)

charles

Robert

04-06-2006, 12:50 AM

Don't let him fool ya.... Charles and time don't belong in the same sentence. lol

They say time is money.... and in his case, he's in the poor house.

/me runs

ozgreg

04-06-2006, 02:06 AM

Yeah I checked out the release notes and I agree with your point of view :( It is strange, back in Dec/Jan Mailfoundry was going strong but lately it is like all the resources on updating spam detection have moved on and nothing is happening :(

I so hope it is not a future trend..

ozgreg

04-06-2006, 02:09 AM

Don't let him fool ya.... Charles and time don't belong in the same sentence. lol

They say time is money.... and in his case, he's in the poor house.

/me runs

Ok who left the cage door open again ;)

charles

04-13-2006, 12:50 PM

Ok who left the cage door open again ;)

Oops, that was me sorry. I'll try not let it happen again :)

I talked to the MF folks, and they gave me the confidence to tunr on the "MessageIQ Anti-Spam v3.0 " engine. Let me know if you see a difference.

charles

ozgreg

04-14-2006, 10:06 AM

Thanks Charles, will let you know how it all goes ;)

ozgreg

04-18-2006, 12:21 AM

So far I have noticed a 90% in the number of spam emails that have been getting past MF filters since the new Beta Spam Filter went online.

Nice to have MF back again as the primary spam filter ;)

charles

05-04-2006, 11:58 AM

Just FYI, we'll be updating the mailfoundry sometime around the 8th-10th.

New Features in Release #MF2006050800:

Watchdog Monitor:
A new watchdog system monitoring service has been added that will
monitor and verify that all system services are running and are
functional. If the watchdog detects a service is not running it
will automatically attempt to restart the service. There are no
options in the user interface for the monitor.

Quarantine System:
The back-end storage system of quarantined messages has been
redesigned to provide greater performance.

RBL Options:
In previous releases when a message was blocked due to an RBL
listing, the message was discarded. With this release you now have
the following options:

- Add "X-MailFoundry: RBL" Header
- Tag Subject line
- Quarantine Message
- Delete Message
- Reject the connection

Branding Options:
An option to display a logo on the appliance login page has been
added. If you have uploaded a custom logo, it will be displayed
instead of the default MailFoundry logo.

Overview Page:
The Overview page has been redesigned to provide more useful
information. A new "Last 24 Hours - By Count" graphic makes it
easy to see what types of messages are being received from the
appliance.

In addition, several other useful details have been added such as
Queue Volume for the incoming, outgoing unscanned and quarantine
queues. To improve performance and load time of the Overview page,
graphs are now created in the background.

Universally Unique Identifier:
A Universally Unique Identifier will now be included in the header
of each message and referenced in the system logs for easy
identification and tracking of messages. You can also search for
a Universally Unique Identifier in the queue status screens.

Queue Status Viewing:
It is now possible to sort the Queue Status pages by the message
date.

RCPT To Error Limits:
A new option has been added to the SMTP settings tab under the
Miscellaneous Settings section where you can define a number of
RCPT To errors per SMTP transaction allowed before the connection
to the remote server is ended. The default value for this option
is 100.

Anti-Virus Engine:
The Anti-Virus Engine has been updated to provide more stability
and better protection from known viruses.

Improvements and Fixes in Release #MF2006050800:

Accepted Domains:
An issue that caused the "Virus Protection" setting to be discarded,
during the upload of a domain list, has been resolved.

Syslog:
Messages from the Postmaster address such as quarantine digests
will now show the local Postmaster address instead of <> in syslog
output and message headers.

ozgreg

05-05-2006, 10:11 AM

Looks good Charles, I be looking forward to giving it another shake out and hope the bugs have gone in this release.. :)

ozgreg

05-11-2006, 02:19 AM

Hiya Charles,

I see we moved up a new release :) So I did some testing for you all again. In summary I still feel MF is still a beta product, it still needs basic UI tweaks to make it user friendly and each release seems to have a fresh batch of bugs which is disappointing :(

Anyway the list..

Bugs

Reports -> Quarantine Totals Counts do no match up to the number of messages in quarantine
Reports -> Quarantine Delete all->Fails to delete all messages in quarantine
Overview -> Last 12 months by percent graph is incorrect (it is graphing months that MF was not running for)

Feature Requests

MessageIQ Settings ->Quarantine Options –> Limit the number of days messages remain in quarantine (up to a global server limit)
Support -> Show Version number so we know what version is currently running
Reports ->Quarantine view -> Releasing a message keeps the message in the quarantine queue (adds a tick next to the message) instead please remove the message from quarantine after releasing.
Reports- >Quarantine view -> When selecting either release / delete from the quarantine queue, after confirming the return link takes you back to the queue status screen, instead please return back to the quarantine view messages
Reports ->Quarantine view ->New option in dropdown to Release & Add Sender to White List
Reports ->Quarantine view ->New option in dropdown to Release & Report as not Spam (Same functionality already in Quarantine Digest)
Quarantine Digest ->New option to delete message from quarantine
Quarantine Digest ->New option to release message and add sender to white list
Quarantine Digest ->New option to delete all messages in quarantine digest
Reports -> Quarantine view ->Remember last sort preferences
MessageIQ Settings ->Quarantine Options->Combine Quarantine Digests for multiple email accounts.

charles

05-11-2006, 09:51 AM

Thanks Greg, I have passed this on to them.

charles

charles

05-20-2006, 01:19 PM

A new update is in the works.

"NEW FEATURES:

A new version of the anti-virus system software.

FIXES:

Admin Interface Restart Bug: An issue may occur where the admin
interface will not restart after a database error or reboot. This
issue has been resolved by enhancing the system monitoring and
restart capabilities.

Quarantine Digests: The digest system will now be case insensitive
when discovering which addresses to generate a digest.

Overview Page: With the MF2006050800 release, images on the overview
page are generated in the background for faster loading. This
process of generating images could cause the system to run low on
system resources on machines with higher numbers of domains. This
issue is now resolved.

HoneyPot Addresses: Several fixes are in place. First, the Unknown
Sender Delay is no longer applied to the HoneyPot Addresses. Also,
when an email with multiple recipients is received by the MF appliance
and one of the recipients is a HoneyPot account, a bounce-back email
failed to be generated for the HoneyPot address in the list (all
emails were delivered and no bounce-back was generated). The proper
behavior is now to deliver to the available recipients and generate
a bounce-back for the HoneyPot address(es).

SMTP Server Logging: A number of logging fixes have been put in place.

MIQv3 Targetted Filters: With the MF2006050800 release, the Targetted
Filters were not being properly applied to the MIQv3 rulesets.

System Updates: Many users reported Error Code 13 appearing in the
admin interface. This error should now be less prone to occur.

Queue Detailed: A problem has been resolved with the viewing of
attachments in the queues.

Queue Counts: Some users have reported issues with the Queue Counts not
updating. This issue has been resolved."

ozgreg

05-20-2006, 11:00 PM

Thanks Charles,

Fingers crossed that this will fix some of the issues plaguing my account :)

Wonder if they might even fix up that bug in the report as well ;)

ozgreg

05-24-2006, 08:40 AM

Hiya Charles,

We got a small issue ;)

The MailFoundry server is unable to download the latest updates for the following reason:

Invalid machine indentification. Please contact support at (888) 305-7776
(Error Code 13)

charles

05-24-2006, 08:54 AM

That's just Mailfoundry's way of saying "hey, installed the update and emailed you about it, not reboot the thing please"

Looks fine now.

charles

Hiya Charles,

We got a small issue ;)

The MailFoundry server is unable to download the latest updates for the following reason:

Invalid machine indentification. Please contact support at (888) 305-7776
(Error Code 13)

ozgreg

05-24-2006, 07:49 PM

Well once again we got a mix bag of results Charles, The really good news it my queue no longer complains with the queue error and I now have correct queue counts.

The bad news is the delete all is still not working, it returns (0 messages have been scheduled for deletion from the quarantine queue.) when it should delete about 90 odd messages and it appears the other graph bug also has not be solved as well..

Sure your emails to MF are not going to /dev/null? :)

charles

05-26-2006, 12:13 PM

Sure your emails to MF are not going to /dev/null? :)

Not sure about anything anymore :)

ozgreg

05-29-2006, 12:30 AM

:)

Charles,

Any chance you can get your hands on the API documentation I would love to code some PHP so I can cut down the number of (unrequired) screens to manage my MF quarantine queue

charles

05-29-2006, 01:43 AM

There is no API yet, which is the main reason we haven't rolled this out as an offering. There is no way we could manage it without automation/integration with our own tools. They are working on one afaik, but I have no details (i have asked to be a beta tester thought).

You can screen scrape it if you want. :)

charles

:)

Charles,

Any chance you can get your hands on the API documentation I would love to code some PHP so I can cut down the number of (unrequired) screens to manage my MF quarantine queue

ozgreg

05-29-2006, 01:59 AM

Yeah I thought about that but it would be a huge pain even if possible because the majority of the issues are within the UI around the stupid 20 lines per page and the dual confirm are you really sure + the return always back to the overview page.

It is just a pain in the ass UI and hoping I can bypass it with my own..

danieln

06-02-2006, 02:08 PM

hi,

just like to find out how's the test going on. this is because i'm having tons of junk and virus mail coming in everyday and i just can't get rid of them

smoore

06-02-2006, 11:25 PM

hi,

just like to find out how's the test going on. this is because i'm having tons of junk and virus mail coming in everyday and i just can't get rid of them

I'm using it successfully, doesn't let much spam through. My biggest dislike is that it's cumbersome to whitelist someone, you have to login to the web application and navigate through several screens. I want a button in the Quarantine Digest you can just click to do it. This is especially important as it's very aggressive and classifies about every newsletter subscription as spam until I white list it, which is really a pain. Even better would be if I could make it less aggressive, like my spamassassin which never had false positives at my preferred setting, so I didn't even have to check the spam box.

I don't know if its just me, but the search box in the reports area doesn't seem to work right, and last time I did "delete all" that didn't work either. However it's at least keeping the spam away, and the price is good :D

ozgreg

06-04-2006, 12:43 AM

Daniel,

Via MF? Are you sure the mail is coming from MF, I have found a greatly reduced Spam rate via MF (only a trickle of spam each day)

Please check the mail headers to ensure you can see Received: from mailfoundry1.defenderhosting.com ([205.234.111.114]) if you cannot then that Spam is being directly sent to your SMTP server bypassing MF..

danieln

06-12-2006, 07:32 AM

sounds interesting.

how bout those mails that are blcoked? where do they go?

ozgreg

06-12-2006, 07:38 AM

Depends on your configuration, I send mine to Quarantine

ozgreg

06-14-2006, 10:27 PM

Charles,

Do you know when (or should I say IF) MF will release a bugfix to fix the non functioning deleteall in Quarantine?

thanks :)

charles

06-15-2006, 02:15 PM

Charles,

Do you know when (or should I say IF) MF will release a bugfix to fix the non functioning deleteall in Quarantine?

thanks :)

Yup, in the next release which will be out in the next few days:

Quarantine Release All / Delete All: A bug which prevented deleting
or releasing all the messages in the quarantine at once has been
resolved.

Full announcement below.

charles

MailFoundry is pleased to announce the next planned release of the
MailFoundry Network Appliance system software. MailFoundry plans
to release the new system software between June 19th, 2006 and June
21st, 2006. Once released you may apply the update using the "System
Updates" option under the "System Settings" menu of your MailFoundry
appliance.

FIXES:

DB Maintenance: An issue has been resolved that would occasionally
have prevented the database maintenance from completing successfully.

Quarantine Release All / Delete All: A bug which prevented deleting
or releasing all the messages in the quarantine at once has been
resolved.

Domain admin searches: If a domain admin would attempt to perform
a search that was in control of multiple domains, they would see
extra results that did not match their search query. This has been
resolved with tighter controls on how the search query is created
on the system.

Quarantine Message Expiration: Many customers have noticed that the
Quarantine queue is not expiring messages at the configured time
interval. This issue has been resolved and messages will be expired
in the first 24 hours after the update has been installed. Due to
the large number of messages that may be back-logged, this initial
deletion will take between 2min. and 20min. to complete and the
results will not be seen until some time afterwards. Mail flow
will be unaffected during that time.

Quarantine Digest Duplication: Some customers have noticed that
some digests can duplicate to some of their users. This issue has
now been resolved.

Background Overview Image Creation: The process that creates the
cached images for the overview page has received some updates to
cut down on system resources.

netrider

06-17-2006, 12:28 PM

Remind me ... What's the URL to logon to our mail foundry account??

Robert

06-18-2006, 08:13 PM

http://mailfoundry1.defenderhosting.com/ :)

charles

06-21-2006, 11:33 PM

Update applied.

charles

netrider

06-23-2006, 07:47 AM

http://mailfoundry1.defenderhosting.com/ :)
Thx :)
And if you username/password doesn't work? :o

charles

06-23-2006, 08:14 AM

Thx :)
And if you username/password doesn't work? :o

contact support :)

charles

07-13-2006, 01:00 AM

Another update will happen in the next few days:

FEATURES:

A new version of the Message IQ Anti-Spam Engine v2.1 is being
released. This new version of the default anti-spam engine contains
new abilities for catching spam attacks. We encourage all users
to upgrade to to take advantage of this new engine. Support for
the MessageIQ v2.0 engine will only remain for a short period of
time so we encourage users to upgrade now to avoid any future
anti-spam detection issues.

FIXES:

Billing Reports: An issue has been identified with the billing
reports for users who wish to include the last date a particular
field was tagged. If you include date fields such as 'last message',
you must go to the Reports Tab -> Custom Email Reports -> Click
on the 'Schedule Report' button in the 'Custom Reports' box.

Domain Aliases: An issue has been resolved for administrators
attempting to add/edit domain aliases.

ozgreg

08-08-2006, 01:56 AM

Charles,

At the risk of putting egg all over my face, I do not believe this update got applied??

charles

08-08-2006, 10:55 AM

Yes it was. If you are not seeing something fixed as they say, please email support and they can contact mailfoundry about it.

charles

ozgreg

08-08-2006, 08:48 PM

Hiya Charles,

Thanks for the info, to be brutally honest I have given up trying to report any issues back to MF as I still see the same bugs I reported 8 months ago.

jechilt

08-21-2006, 12:57 AM

TomK

08-21-2006, 08:41 AM

Has there been a change with the system?
A few of my customers are complaining about a huge increase in spam and my mail accounts are being blasted with spam. Normally, I see 4 or 5 a day. In the last few hours, I have received over 100.
Any info???

Nothing has changed, no new updates loaded, etc. Not sure if this is what you are seeing, but about 5 days ago the quarantine queue was releases, which sent out everything in the queue, not sure why this happened.

orenatsmart

08-21-2006, 11:20 AM

Nothing has changed, no new updates loaded, etc. Not sure if this is what you are seeing, but about 5 days ago the quarantine queue was releases, which sent out everything in the queue, not sure why this happened.

Tom,
I also saw the same thing yesterday (Sun Aug 20) - a huge (1000+) flood of spam released from quarantine.

Oren
oren@sphost.biz

ozgreg

08-24-2006, 04:05 AM

Charles / Tom,

Confirm MF is just broken right now and getting a tide of SPAM. :(

I only had 14 messages in my quarantine queue (usually I have a few 100 odd) so something is very fundamentally broken..

Any chance you can get the MF guys onto this ASAP?

TomK

08-24-2006, 04:21 AM

I'm just starting to think MF is a lost cause to be honest, problem after problem, patch after patch, and these major issues still exist.

We'll be looking for alternative products immediately, if you know of any, post em up for consideration.

I'm just tired of having to worry about stable spam-free email every day.

We have a cuda 400 in place, and I'm not any more happy with that product either to be honest.

We'll be winding down the MF "beta" program here shortly (30 days or so).

Tom

ozgreg

08-24-2006, 05:30 AM

I feel your pain Tom, I do not know what has happened with MF, every new patch in the last six months has just fundermentally broken things and I will not even get started on the missing functionality promised but never delivered etc..

Hoping you will not wind down MF Beta until something else is in place although :(

ozgreg

08-24-2006, 05:36 AM

I take it -> The barracuda is no good as well??

http://www.barracudanetworks.com/ns/products/spam_specs.php

TomK

08-24-2006, 07:46 AM

nadzri

08-24-2006, 11:50 AM

I'm just starting to think MF is a lost cause to be honest, problem after problem, patch after patch, and these major issues still exist.

...

We'll be winding down the MF "beta" program here shortly (30 days or so).

Tom
That's unfortunate. After that spam flood problem a few days ago, I just realised how well MF has done, for me at least. Having used it, spam has generally reduced to a trickle. It's where "no news is good news." And having a few hundred emails fewer to process, server load is also lower throughout the day. Only when it's gone will we truly realise how useful it was. :)

Thanks for the service!

Fred

08-24-2006, 01:43 PM

you probably though about it, but there's mailscanner and it's free...
There's a lot of docs and ressources about it.

Since 6 months, it's better than ever for ressource usage. It's still heavy but not as much as before. And the virus scanning disabled, mailscanner will be less heavy.

For the User interface... well, mailwatch exists and works pretty well for me. But i didn't enabled a multi-user usage ... so i can't tell...

jechilt

08-24-2006, 05:05 PM

Back in March I suggested Bizanga http://www.bizanga.com/ . Since I never saw anything on the forum, I figure it was not considered. It does seem to be a good tool.

On another note...has anyone else noticed delivery delays. My busiest client called today and said they did not get email for 3 hours yesterday (12pm - 3pm CT). Today, they again noticed about an hour of no messages coming in.
I need to isolate whether this is happening on the MF server or if it is happening on the client end. I tend to lean on the MF server right now because the client has connectivity, can send/receive through alternative addresses and can continue to send through the address that is on the MF server.

TomK

08-24-2006, 05:23 PM

Thanks, we'll take a look at that Bizanga product.

I would say at this time the delay is MF based, we've been hearing that from many customers but the queue shows nearly empty, so we're lost.

Tom

jechilt

08-31-2006, 07:21 PM

any new information available yet?

TomK

08-31-2006, 09:53 PM

No, but you should plan to get your domains off the mailfoundry, we'll announce something and give customers 30 days when we have something else we are ready to test.

rossh

09-01-2006, 06:45 AM

Cuda's are a bit more stable, however they cost a lot more and the tagging results were not that much better, if at all, over the MF.

MXlogic is nice as is postini, hosted solutions, and they don't have the concept of domain protection, just user/account protection from what I've been told.

IE; $2 bucks a month to protect joker@defenderhosting.com and not just *@defenderhosting.com, so the cost is an issue, as it is most times!

I have PostIni. Yes it can be set up to do a catch all into one address on PostIni (including across domains). i.e. *@abcd.com can all be run through a single default identity on PostIni. The message is still delivered to your final MTA with its original To: address. You only pay minimum charges - not $2 an address this way. I have to buy my service from a reseller, but someone Defender's size would get the full package.

Rossh