Spam Packages - Opinions Wanted! 1

[Datanomics]

I manage 2 networks:
-- 1 has a Windows 2003 SBS running Exchange 2003
-- 1 has a Windows 2003 Std server running Exchange 2003.

Both are getting innundated with spam. I am using IMF but it just isn't cutting it. I'm looking into purchasing a 3rd party spam blocking package. My first call is to McAfee since both servers are running McAfee GroupShield.

But above & beyond that, I would love to hear opinions on what has / has not worked for other environments.

Thanks for your time!

 

[Zelandakh]

Very true - if you budget is $100 then you will be limited!

Bandwidth is another important constraint as edvin has said. If you have a device on your LAN then all spam comes across your bandwidth - cloud based anti spam would stop that happening.

 

[rjs]

Postini gets my vote. The cost is excellent, especially after you consider hardware, software, maintenance and BANDWIDTH. For our 70 person firm, our e-mail gateway (anti-spam, anti-virus) was processing approximately 100,000 messages per day. After Postini (no gateway required), we are down to less than 5,000.

 

[ThePhatCoder]

Here's my two cents...

I can vouch for GFI MailEssentials. It's well supported and maintained, easy to install and requires minimal administration. Very well priced for SMBs and highly effective against SPAM. It's got good reporting facilities (the last month averages 95% spam detected, with very few false positives).

Having said that, I think cloud based anti-spam is the future. It'll protect from 'spam storms' and should in theory be more effective due to the centralised nature of tracking high volumes of messages.
If your budget will stretch to it, give Messagelabs a try.

 

[ColdFlame]

I'll throw in my vote for Ironport. We made the leap into Ironport just before they were bought by Cisco and have been VERY happy with it. With exception of upgrades, I basically leave it alone and don't have to worry about it. Their support team is also excellent (We bought the Platinum service plan).

Cheers,

ColdFlame

 

[58sniper]

I've heard the same about Ironport. Seems that Ironport is far more popular in the enterprise space, and Barracuda is popular in the SMB space.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[ColdFlame]

You may also want to look into this. An exchange-admin friend of mine at a very large company uses it.

It's called Spam Filter ISP (

http://www.logsat.com/sfi-spam-filter.asp)

He has nothing but good things to say, and the cost is very reasonable per year. They run theirs right on the Exchange server so it isn't very heavy on the system resources and he said it was basically a "set and forget" solution as well. At worst case, he has to restart the services on it once or twice a year according to him. It also has a fully functioning 45 day demo to try out too.

It also has an optional AV plugin as well for an additional cost. I looked into it and was very pleased with what I saw, but the guys above me wanted an appliance rather than software.

Cheers,

ColdFlame

 

[Datanomics]

This has been fabulous information - thank you all. As I've been reading your comments & questions I realized I should've given you some more uber-basic information about the environment here:

-- The 1 network, with a Windows 2003 SBS running Exchange 2003, has 3 users (yes, 3) & ~15 mailboxes. 2 domains.

-- The other network, with a Windows 2003 Std server running Exchange 2003, has ~25 users & ~35 mailboxes. 1 domain.

Budget: I don't have one. I have to plead my case on a per-issue basis. That goes from backup tapes to servers to phone system warranties. Each purchase has to be explained & justified in order to be approved. ZERO room for 'luxury' purchases (Like... setting up a test environment - it's implement live, hope for the best & keep backup tapes close at hand...)

As for software vs hardware in this case - I'm leaning towards software at this point.

 

[58sniper]

Virtual Server on a 4GB laptop is a great test lab. I have about 30 virtual servers built on mine.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[mobyduck]

Have you considered SpamTitan ? I have a similar setup to you as far as pleading for financial resources is concerned, so I looked at putting in my own hardware solution based around SpamTitan.

The upside of this is that if you have any old PC boxes laying around doing nothing the linux based software will install beautifully and is easy to manage from any desktop on the network even if like me you haven't a clue about the finer points of BSD.

It also allows for filtered spam to be available for interrogation in case of false positives - you can set the retention period yourself.

 

[Datanomics]

Hey all...

I just wanted to thank everyone for their help & opinions.

I ended up installing an eval copy of the spam add-on to McAfee GroupShield. While it does the job it's barely customizable & their own techs (who I have ALWAYS had extremely good experiences with) seem to be at a loss. Apparently McAfee doesn't fully endorse this add-on but rather another package / device instead. That's helpful.

It was Zelandakh who said "IMF when configured well is extremely good." So I decided to take another look. And I HAVE been making progress. Especially as of late when I came across this fabulous tool:

http://www.accendo.co.uk/blog/?p=4#comment-646

Anyway, just wanted to say thanks once again!

 

[mofusjtf]

I know it's a bit late but you should look at Trend Micro's Worry-Free Advanced Suite. They have a hosted solution similar to postini (which works great) and you can also run it resident on your exchange server. The price of their products is good too.

 

[58sniper]

Google's Postini is very popular, and quite robust. AppRiver's service is pretty good. I love their commercials ("faster nerds...").

Using cloud services reduces bandwidth used by mail since only legitimate email comes across the connection.

IMF rules, though, and is a great solution. In 2007, we also have many more agents to work with, including an entire server role (edge transport) that's designed just around hygiene.

Glad to see you're making progress.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[Datanomics]

mofusjtf -

No, you're not late at all. While I'm currently giving IMF another try I certainly haven't closed the doors to other options. I'm just seeing if I can get IMF to do everything I want / need it to.... So thanks!

 

[mofusjtf]

Yes, the IMF is great! But it can't scan emails over 3mb(I think) So using this with another product usually is the best approach.

I prefer Trend because you can by the Worry-Free Advanced Suite and get desktop, laptop, server and email protection. You actually get 2 email protection options. 1. you run resident on Exchange. this works great! 2. you get the hosted option that is similar to Postini. I typically use option 1 because I deal with a lot of SBS servers that do not process a large volume of mail. If you have a large volume of email you might want to use the hosted option because resident email scanners that run on Exchange servers use memory mapping and can cause performance issues.

Do you get a lot of Spam from your own domain? If you do not have any SMTP clients or applications that send notifications through SMTP you can use the Sender Filter in Exchange and block your own domain. This will not impact internal mail because it is MAPI. It works great so long as no clients or applications need to send SMTP mail from your domain.