mail filter recommendations

Forums › IT Pro and developers › mail filter recommendations

dt

1152 posts

Uber Geek
+1 received by user: 371
Inactive user

#272989 29-Jul-2020 11:01

We have been using SMX for a while at work now and as each year goes by I am less and less happy with their service and their lack of functionality

I did look at proofpoint on the recommendation of our firewall vendor and really liked the product but it was literally 10x the price that we currently pay to SMX and while I could see the value others didn't

After some real world recommendations of something that has good support spf, dkim and dmarc.. the ability to recall mail from users mailboxes, easy to manage rules and good av filtering, the ability to sandbox would be a bonus but not a requirement at this stage

I think i'll have a better case to work with to spend a bit more money now having more people working from home but we are limited with funds and would be interested in geekzoner recommended alternatives

Our mailserver is on prem and while a hosted mail filtering solution is preferred im not opposed to an on prem solution either

cheers

edit: didn't want to name and shame.

1 | 2

4015 posts

Uber Geek
+1 received by user: 1852

ID Verified

Trusted

Lifetime subscriber

#2530665 29-Jul-2020 11:31

Have a look at SpamTitan. Our experience has been positive, and you can self host or use their cloud.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

ResponseMediaNZ

518 posts

Ultimate Geek
+1 received by user: 196

ID Verified

Trusted

#2530696 29-Jul-2020 12:37

@dt - Have you see the new product SMX has brought out? Their new SMX Accelerate seems better than the older products.

are you just running their filtering at the moment?

networkn

Networkn
32864 posts

Uber Geek
+1 received by user: 15454

ID Verified

Trusted

Lifetime subscriber

#2530706 29-Jul-2020 12:58

We like Spam Titan as well.

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2531030 29-Jul-2020 20:02

Consider that it's unlikely that a third party mail filtering system is going to be able to reach into people's mailboxes and retrieve emails (for example).

I'm interested to hear details of what's specifically puts you off SMX, what your expectations would be of an alternative.

No signature to see here, move along...

timmmay

20858 posts

Uber Geek
+1 received by user: 5350

Trusted

Lifetime subscriber

#2531057 29-Jul-2020 21:15

I gave up hosting a server for personal email years ago, it's too much work. Can you simply move to a hosted email server that does this for you?

lxsw20

3689 posts

Uber Geek
+1 received by user: 2174

Subscriber

#2531068 29-Jul-2020 21:26

I've used and liked mimecast in the past, but it could very well be the product that cost 10x the price you're talking about.

New World

Shop on-line at New World now for your groceries (affiliate link).

dt

1152 posts

Uber Geek
+1 received by user: 371
Inactive user

#2531129 29-Jul-2020 21:59

BlakJak:

Consider that it's unlikely that a third party mail filtering system is going to be able to reach into people's mailboxes and retrieve emails (for example).

I'm interested to hear details of what's specifically puts you off SMX, what your expectations would be of an alternative.

I've seen it happen in a working demo, the way I understood it is that it was made possible via adding a service account with the necessary permissions to the exchange server and executing exchange powershell commands i.e search this/these mail box(s) for this mail id and move/delete but was done via a super simple web gui.. which would work quite well for us as we appear to be a target of malicious campaigns where we get bombarded with 100s of slightly variegated emails where they sometimes get lucky with dozens of them getting through.. all off a sudden we have dozens of people we need to track down where it would be just heaps easier to just delete the email from their mailbox instead.. the other cool thing you could do was one click blacklist the urls contained in the mail file, however this was apart of the mail filters integration with our firewalls so not expecting this type of feature with anyone else

You've made me think with your question and I guess they do an alright job to be honest, i'm just wanting to explore different options at the mo as we've had to many near misses with them over the years and my biggest gripe is that if they've missclassified something the only option is to whitelist the sender and have them resend the email (so im told).. there is just a lack of advanced functionality with their platform imo

fortunately a heavy majority of our 950ish user base are quite good at avoiding potentially malicious email as we've put a lot time and investment into user education by way of mandatory and regular online phishing email identification courses with ongoing regular simulated phishing emails so we can keep a eye on the worst offenders for additional support and education and see who is not actually reporting phishing emails after they've clicked through them(they dont know they are simulated and that it all logged) and positively who is reporting them where we average some of the highest results according to the product vendor.. but its the real ones that do get get through which is more often that we would like and possibly dont get reported are my biggest concern

We get a fair bit of mail coming through our organisation each month and it just feels like we are spending way more time than we should managing emails that shouldn't have made it through which ends up being very resource intensive

Thanks to those who suggested spam titan, I remember this being the go to product when I was working at an MSP about 10 years ago and had completely forgotten about it.. I see their interface has hardly changed and reminds me of web titan..

Still keen to hear what others are using

dt

1152 posts

Uber Geek
+1 received by user: 371
Inactive user

#2531130 29-Jul-2020 22:04

lxsw20:

I've used and liked mimecast in the past, but it could very well be the product that cost 10x the price you're talking about.

Cheers i'll have a look into it, the product I was referring to was Proofpoint, it was recommended because of integrations it had with our current firewall vendor

dt

1152 posts

Uber Geek
+1 received by user: 371
Inactive user

#2531131 29-Jul-2020 22:07

timmmay:

I gave up hosting a server for personal email years ago, it's too much work. Can you simply move to a hosted email server that does this for you?

yeah same here, not worth the hassle.. move my personal mail over to zoho a few years back and never looked back.

I was under the impression with exchange online it was still best practice to have someone else washing your mail for you?

Dynamic

4015 posts

Uber Geek
+1 received by user: 1852

ID Verified

Trusted

Lifetime subscriber

#2531181 30-Jul-2020 08:16

dt: I was under the impression with exchange online it was still best practice to have someone else washing your mail for you?

It's more about layers of security. If Product X doesn't capture it, Product Y should.

Also... your receive connector rules should filter out a large list of attachments simply by extension. It won't stop a .docx with a malicious payload, but it will stop an invoice.pdf.exe etc.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

dt

1152 posts

Uber Geek
+1 received by user: 371
Inactive user

#2531210 30-Jul-2020 09:06

ResponseMediaNZ:

@dt - Have you see the new product SMX has brought out? Their new SMX Accelerate seems better than the older products.

are you just running their filtering at the moment?

@ResponseMediaNZ, I've just had a look and we are using their "Secure email gateway" product.. I've looked up their accelerate and at first glance the only difference I can see is that it includes a mail archiver.. I'll email our account manager and see if theres more to it than that or not though, cheers!

Mighty Ape

Shop now at Mighty Ape (affiliate link).

1101

3141 posts

Uber Geek
+1 received by user: 1143

#2531291 30-Jul-2020 11:25

Spamblocker
http://www.spamblocker.co.nz/index-1.html

NZ based
Excellent phone support

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2531531 30-Jul-2020 18:17

dt:

I've seen it happen in a working demo, the way I understood it is that it was made possible via adding a service account with the necessary permissions to the exchange server and executing exchange powershell commands i.e search this/these mail box(s) for this mail id and move/delete but was done via a super simple web gui.. which would work quite well for us as we appear to be a target of malicious campaigns where we get bombarded with 100s of slightly variegated emails where they sometimes get lucky with dozens of them getting through.. all off a sudden we have dozens of people we need to track down where it would be just heaps easier to just delete the email from their mailbox instead.. the other cool thing you could do was one click blacklist the urls contained in the mail file, however this was apart of the mail filters integration with our firewalls so not expecting this type of feature with anyone else

The service account thing makes some sense, that's not an angle i'd thought about. Thanks for explaining.

In an enterprise environment, being able to accurately withdraw known malicious emails from users inboxes is a neat feature. My team had a bunch of canned powershell scripts for this purpose when we had on-prem exchange. I'll admit to not knowing how to do it with EOL.

I have been known to do similar on a linux MTA with a root shell ;-)

You've made me think with your question and I guess they do an alright job to be honest, i'm just wanting to explore different options at the mo as we've had to many near misses with them over the years and my biggest gripe is that if they've missclassified something the only option is to whitelist the sender and have them resend the email (so im told).. there is just a lack of advanced functionality with their platform imo

fortunately a heavy majority of our 950ish user base are quite good at avoiding potentially malicious email as we've put a lot time and investment into user education by way of mandatory and regular online phishing email identification courses with ongoing regular simulated phishing emails so we can keep a eye on the worst offenders for additional support and education and see who is not actually reporting phishing emails after they've clicked through them(they dont know they are simulated and that it all logged) and positively who is reporting them where we average some of the highest results according to the product vendor.. but its the real ones that do get get through which is more often that we would like and possibly dont get reported are my biggest concern

We get a fair bit of mail coming through our organisation each month and it just feels like we are spending way more time than we should managing emails that shouldn't have made it through which ends up being very resource intensive

Thanks to those who suggested spam titan, I remember this being the go to product when I was working at an MSP about 10 years ago and had completely forgotten about it.. I see their interface has hardly changed and reminds me of web titan..

Still keen to hear what others are using

Fair enough, good to look at the market.

Full disclosure: I worked for SMX between 2013 and 2015.

Their error message when a message is refused due to being suspected spam, provides instructions to the sender on what to do ('send the misclassified message to emailsupport@ )which lets them submit a correction to their spam detection engines. This only takes a few minutes.
If you're the receiver, and the sender can't manage to do this themselves, then you're right - a whitelist policy will let you receive the message, and then you can submit it to SMX yourself.

I'm a bit surprised after all these years, that they havn't yet improved the system for this, that's disappointing but I also understand how they have to approach it with care, even the most straightforward UI's attract mistaken classification rules and as a cloud service, the impact is to their entire platform (or even further upstream, as they use commercial vendor solutions to define spam).

Hope this helps, will be interested to see how you land. I still recommend SMX, at the end of the day, working with a domestically located vendor who will listen to your issues, and help you develop custom solutions, and are readily accessible, is always more successful in my experience than going into an offshore multi-national with no flexibility and no ability to effectively escalate issues when they develop.

No signature to see here, move along...

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2531532 30-Jul-2020 18:17

btw being limited to a single layer of quotes is annoying. :S

No signature to see here, move along...

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2531743 30-Jul-2020 21:15

1101:

Spamblocker
http://www.spamblocker.co.nz/index-1.html

NZ based
Excellent phone support

That website is awful. It literally has a copyright date of 2011 and no suggestion it's been updated in 9 years!!

Use of text highlighting in blue which happens to be exactly the same style as hyperlinks. So you can't tell which text are links, and which are just formatted to look like links.

Their list of resellers must be old - at least one of the domain names listed doesn't actually resolve an MX record.

None of the resellers appear to actually consume the product they're reselling.

Stacks of plain-old mailto: links on the website, as if they're deliberately seeding them as spam targets. (!)

No actual information about how their product works except that they appear to take over your MX record (fairly standard).. but see above, none of their resellers use the product!

... and it gets worse. Their domain name is registered to a company which was removed from the companies register in 2017. The name 'Spamblocker' is now a Trading Name for 'Hosted Online Limited' who has the same director. Browsing the Hosted Online website derides 'face-less' companies but then fails to actually tell you anything useful about the company in the 'about page', no names, not even the legal name of the company.

Very little in Google about the product, the service, or the founder/director, and the lack of information .... this is not an enterprise ready product offering.
None of the above would give me the confidence to have all my email forwarded through the service.

No signature to see here, move along...

1 | 2