Hide full article
From what I gather, the spam problem continues to worsen, but thanks to the domain-level anti-spam service from Postini, I and others who receive mail at tidbits.com are no longer drowning in a fetid tide of spam. That's not to say that Postini has completely eliminated spam for us, but I was receiving about 1,000 pieces of spam per day before Postini, and now only 10 to 30 per day make it through to Eudora (where SpamSieve promptly dumps them into my Junk mailbox).
As these numbers show, Postini is not a magic bullet. Spam hasn't disappeared entirely from my life, and in fact, I now have two quarantines (Eudora's Junk mailbox and Postini's online webmail-like quarantine) to check for false positives. But the constant onslaught has abated, and the psychic toll it exacted has lessened by an astonishing amount. Postini isn't perfect, but I in no way regret signing up with them, and it's easily worth the $1 per protected account per month that digital.forest charges for the service.
Initial Pain -- There are two basic modes for Postini, setup and regular usage. You only go through setup once, though if you're the administrator for your domain, you may have to dip into the Web-based administration interface occasionally to tweak settings for a user. Unfortunate though it was for this review, Postini significantly improved the administration interface after I set up my account, making it difficult for me to say exactly how it would work now for someone coming in fresh.
That said, when I set up my account under the previous administration interface, I was unimpressed. The interface was confusing and arcane, and only with the help of Bill Dickson (my co-author on my second book, Internet Explorer Kit for Macintosh, and now a technical guru at digital.forest) was I able to figure out an appropriate strategy for our setup.
Here's the problem. Like most domains, I have a number of real users (mostly staff and family), and I wanted their accounts to be protected by Postini. But I also have quite a few alias accounts that come to me (or to other staff members) and unlike most domains, we run a slew of mailing lists and auto-replies, each with their own addresses. I didn't want to pay for each of these automated accounts (since that would radically increase our overall cost), nor did I want to take the time to check the quarantines for each one on a regular basis. So Bill and I worked out a four-step approach.
First I identified all my real users in Web Crossing, made some lists, and informed them manually of what was going to happen. Importing those addresses into Postini was easy, although glitches in the previous Postini administration interface meant that people didn't receive custom welcome messages properly. Second, I added the alias accounts to the appropriate real accounts; Postini charges on a real user basis, so there's no downside in having lots of aliases. Third, instead of trying to identify and import all the automated accounts, I changed Postini's "default user" such that spam filtering (and thus charging) was turned off, and I turned on automatic account creation. Fourth and last, I changed the MX records in my DNS settings so all mail to tidbits.com flows through Postini's mail servers before it comes to my server.
This third action - automatic account creation - turned out to be subtle and important. It would be nearly impossible for me to identify every automated account we have and might create in the future, particularly because it's so easy to set up a mailing list in Web Crossing. Postini's automatic account creation looks for legitimate incoming mail, and creates accounts automatically, but since it's always possible that spam will appear to be legitimate (or that someone will just type a username in a tidbits.com email address wrong), it's important that those automatically created accounts not employ spam filtering and thus stay out of our monthly bill.
I discovered the problem with automatic account creation shortly after enabling Postini. I connected to the administration interface and found my account included not hundreds, but many thousands of users. It turns out that Web Crossing, like some other mailing list management programs, sends messages to list subscribers from unique addresses, making it easier to link particular subscribers with bounce messages that come back. In essence, this meant that for every bounce that came into Web Crossing, Postini created a new account (nearly 23,000 so far). Although there is no way to delete all these bogus accounts as far as I can tell, they don't appear to get in the way, so I've just left them alone. The other downside to this approach to creating unprotected accounts automatically is that when I do want to create a new protected account, I have to do that manually. That's fine, though, since such an action has a real-world cost attached to it.
In the end, although my feeling is that Postini's current administration interface is a lot more understandable than the previous one, you must still think carefully about what you want to do if you regularly create new accounts that either should or should not be protected by Postini.
In fact, I've mostly gone into the administration interface to add many of my mailing lists' management addresses to my account as aliases. That enables Postini to weed out the vast majority of the malformed spam that was causing conniption fits for our elderly ListSTAR server, and since I check for false positives in these accounts simultaneously with checking for my main account's false positives, there isn't much added work. In some cases, the aliases actually save effort, since seeing three to five spam messages with identical subjects makes for easier identification than if I had to read the subjects more closely.
Regular Usage -- Everything I just described is of interest only to the person who will be managing a Postini setup. Normal users whose email addresses are protected by Postini don't have to mess with any of that and enjoy a significantly simpler experience. Here's how I use Postini as a normal user.
I've set up Script Software's iKey to open the Postini Message Center Web page automatically every morning at 9:00 AM. The Message Center is basically a webmail client that shows you two lists of messages: the Virus Alert list containing virus-infected attachments, and the Suspicious Junk Mail list of messages that Postini thinks might be spam. For each message, you see the sender, the subject, and the date, and for the possible spam messages, there's also a column that tells you what category of spam the message might belong to (generic bulk mail, naughty bits, get rich quick schemes, special offers, or - one I've never seen triggered - racially insensitive messages). You can sort the lists by any of these columns; sorting on subject works well for me because of the many duplicate messages I get.
<http://www.scriptsoftware.com/ikey/>
I ignore the Virus Alert quarantine list, so Postini automatically deletes messages with virus-infected attachments after some period of time. The main reason for ignoring these messages is that as a Mac user with a widely known email address, my address is spoofed by worms all the time, resulting in a lot of virus-infected messages sent to me, and another bunch bounced back to me after my address has been used for the From line. Today alone I've received nearly 70 such messages. Since the likelihood of me receiving a legitimate but infected attachment is next to nil, there being almost no Mac viruses, even scanning the list seems a waste of time.
I do feel badly for PC users who might want to see messages with infected attachments, since Postini's webmail-style interface is lousy here. Although you can sort by sender, subject, and date, you can display (and thus remove) only 10 messages at a time. If there is a legitimate message, you can click its subject to view and then choose to deliver it as is, or fix and deliver; I have no way of knowing how effective the fixes are (Postini uses anti-virus software from McAfee).
The Suspicious Junk Mail list isn't limited to displaying only 10 messages at a time; it can show up to 200. You can of course click a subject to view the associated message, and for those legitimate ones that are caught incorrectly, you can choose to deliver them, or deliver them and add the sender to a whitelist. There are also shortcut controls for removing all the visible messages and delivering selected messages.
Postini's user interface suffers in comparison to webmail clients I've seen, but it is functional. At first, I found it rather clumsy, given the amount of spam I get and the frequency of false positives (one or two per day). I've subsequently figured out a usage technique that works extremely well. First, I click the link that selects all the messages, 99 percent of which are spam. Then I scroll through the list, scanning the subject column for potentially legitimate messages. This task turns out to be easy, perhaps easier than in Eudora because of the extra white space in the display. For each legitimate message, I deselect its checkbox. At the end, I click the Remove button to trash all the spam, leaving just the legitimate messages. Then I select all of them, click the Deliver button, and for permanent sender addresses (as opposed to the temporary bounce addresses used by some mailing lists) I add them to my whitelist. For those temporary bounce addresses, I copy the domain, click the Junk Email Settings link, and add the entire domain to the whitelist (it would be more efficient if Postini offered an option to add either the full email address or just the domain during the approval process; such interface niceties are generally missing in Postini). Don't assume you can use the whitelist as you would in a client email program; it's reportedly limited to 4,000 characters, and should be used only for the addresses sending mail that Postini is filtering incorrectly.
Most of my other users don't receive nearly as much spam, so they visit their quarantines less frequently (Postini can send reminder messages to let you know you have quarantined mail waiting) and are less likely to see false positives. Some people, including Tonya, have decided they're too busy to bother checking, so they undoubtedly miss a few legitimate messages here and there.
The main feature Postini's Message Center lacks is a search field - if you're missing a message, being able to search for it rather than scroll through all the possibilities would be a great help, particularly for those users who don't visit the quarantine regularly.
Filtering Accuracy -- Just how good is Postini's filtering? I wish I could say for sure, but metrics are tricky for a number of reasons. Before anything else, Postini checks incoming messages against what they call the Blatant Spam Blocker, and from what I can tell, that takes out as much as 80 percent of my spam without even letting it into my quarantine list. I was receiving about 1,000 spam messages a day, and now my quarantine shows me about 125 messages a day. However, remember that my quarantine actually displays spam messages received by over 30 accounts, whereas my 1,000 messages were to only about 5 accounts. Of those 125 per day, it's entirely common for 1 or 2 to be legitimate, although I can usually understand why Postini would have considered these messages suspicious. I receive a lot of press releases and mail from companies about product offers, and it's difficult to differentiate them from the latest too-good-to-be-true offer from a spammer. Then there are the 10 to 30 spam messages that Postini allows through. Further confusing the measurements is the fact I haven't yet locked down Web Crossing's SMTP server such that it accepts incoming SMTP mail only from Postini and a few of our servers, and some spammers deliver mail directly to our Xserve's IP number, thus bypassing Postini entirely. (That configuration change will be happening soon; I hadn't realized how much spam was coming in that way.)
Overall, Postini claims 95 percent accuracy and less than 1 percent of false positives, and that seems roughly accurate. SpamSieve is better, though comparing a single-user tool like SpamSieve to the multi-user Postini isn't quite fair.
These numbers raise the question of exactly how Postini filters incoming mail. My contacts at Postini won't say exactly how the system works, presumably to keep spammers from circumventing it, but the FAQ says they use "an advanced filtering technique ... built on heuristic rules, lists of approved and blocked senders, and databases of known junk email." In other words, Postini is a black box, though a black box whose sensitivity you can set in certain categories. Remember those categories I mentioned earlier? You can adjust, on a five-point scale, Postini's aggressiveness in holding suspicious messages in your quarantine. The more aggressive your settings, the fewer spam messages will make it through Postini, but the more legitimate mail will be caught in the quarantine. That's the other reason I was waffling on how effective Postini has been - I've chosen somewhat aggressive settings, and I've been slowly increasing the aggressiveness as I become more comfortable with how Postini works. There are default settings for a domain that the administrator can set, and every user can override them individually.
One annoyance is that Postini apparently analyzes only mail written in English. Since I get a vast amount of spam from China, Korea, and Japan, it's frustrating to know that Postini could catch more those messages, since almost all of them (short of the Japanese translation of TidBITS) are guaranteed to be spam, given that I can't read any of those languages. Despite this limitation on language analysis, Postini still clearly eliminates a great deal of foreign-language spam during the Blatant Spam Blocker pass, and a good many messages that appear in my quarantine are also in other languages and character sets.
Can Postini be trained? Yes, but not by individuals, short of your whitelist and another list of permanently blocked senders. You can forward spam that gets through to Postini, but doing so merely suggests the message as one to learn from. Although that may make you feel powerless, it makes sense, since people are notoriously inaccurate when identifying spam, particularly now that many people consider any message they don't want as spam, even if they signed up to receive it. However, Postini provides service to 3,700 domains with 5 million end users, who receive 1.3 billion messages every week. That volume is almost unimaginable, but it ensures that Postini has a massive store of spam to analyze for patterns. The volume also explains Postini's conservative approach to improving the end user interface and allowing user-based training.
The current administration interface does offer some reports for the administrator, so I can tell, for instance, that Postini lets about 70 percent of incoming messages to tidbits.com go through, and quarantines about 30 percent. I can see which of my users receive the most messages, the most spam, and the most viruses. The reports appear to go back only about 45 days, though, limiting their utility for trend reporting.
Ambivalence and a Recommendation -- You may have noticed a certain level of ambivalence in my report so far. It stems from the fact that Postini is not the be-all and end-all of anti-spam services. Its methodology is unknown, and not as good as other tools I've seen. Its interface is usable but mediocre, unless you need to scan virus-infected messages, at which point it's poor. It doesn't allow user-level training and doesn't pay full attention to mail that's not in English. And it isn't smart about ignoring, or allowing the mass deletion of, temporary addresses used by mailing list software for bounce tracking. In short, Postini is not an ideal service for the technically savvy email administrator who understands anti-spam techniques and enjoys getting a little dirty while maintaining an anti-spam system. Such people should stick with lashed together open-source anti-spam programs, which can be highly effective, if time-consuming to set up and maintain. (Contributing Editor Glenn Fleishman has set up such a system, and we hope to tell you about it soon.)
Years ago, I fell more into that camp. Now, I'm just sick of thinking about spam, and if Postini can do as good as job as I've seen it do on my mail for $1 per month per account, that's money well spent and time happily regained. Not long ago, I received a renewal notice and $200 invoice from the MAPS service, which sells access to a real-time blackhole list that we used before our switch to Web Crossing. I'd forgotten that we paid $200 to MAPS each year; now Postini seems like an even better investment, since our yearly bill won't be too much more than the MAPS payment. My users have gone from moaning about how much spam they got to gushing about how completely Postini has solved their spam problems. My mail and list servers, all four of which have been taken out by malformed spam at one time or another (and which often require significant effort to bring back online), are more stable. As I said at the start, being able to stop dealing with the massive influx of spam has been a huge psychic weight off my shoulders.
There are of course competitors to Postini, and I even received pleasant email from several of them after I announced our Postini trial, offering similar free trials. In an ideal world, where I had the time and energy to satisfy my intellectual curiosity about everything, I would have taken them up on their offers. But as it stands, I can't imagine turning off Postini in favor of something that might not work as well.
So, despite my technical ambivalence about some of the ways in which Postini is implemented, I definitely recommend the service to anyone who needs to deal with spam to an entire domain and doesn't want to think about it much after setup. (If you have a normal email account at an ISP, you can't use Postini unless your ISP offers it.) The price I've been quoting - $1 per month per account - is available only through digital.forest, the network service provider and Web hosting service we've long relied upon and recommend. It may be more cost-effective for large organizations to work directly with Postini, but if you don't have thousands of accounts and are interested in using Postini's services, contact digital.forest via email at <sales@forest.net> or use the phone: 877-720-0483, option 2. You might need a little hand-holding with your setup, but I hope my explanation how you want to configure Postini for real accounts, alias accounts, and with automatically created accounts helps smooth the process a bit. In the end, I think you'll be happy with Postini's service.
<http://www.forest.net/>
