HERMES - Mail Filters

Mail Filters

The growing amount of spam (unsolicited commercial/pornographic/etc bulk mail) makes it necessary to use mail filters by both, the incoming mail server and mail clients. No anti spam filter is perfect (100% effective). Spam senders continuously develop new ways of getting their spam across possible filters. Therefore, the more filtering stages of mail reception the better.

HERMES internal filter rejects messages that are:

addressed to non-existent recipients,
coming from non-existent sender addresses,
obvious attempts at a forgery in message headers or detected to contain a specific virus in their bodies/attachments,
relayed by blacklisted servers, that is known to be spam sources or so-called open-relays or open-proxies.

It is under control of HERMES administrators who vie to keep it continuously updated and upgraded.

Relay Delay Filter (RDF) is under user's control. It can be switched on and off any time for any of addresses associated with a hosted domain by a click on Login, then on Domains, and on view/edit in the domain line, and on ON/OFF in the address line. By default it is ON.

It never rejects any message. It may only delay reception of certain messages for some time that depends on the sending computer. For each of its users, it maintains 2 lists, the greylist and whitelist. When a message comes, say to the address info@hosted.domain.com from a machine whose so-called ip number is 123.231.123.231, for the first time, the machine gets a signal of temporary failure of our server and an invitation to resend the message in 7 minutes. The machine ip number and the current time are recorded in info@hosted.domain.com greylist. In the next 7 minutes, the record is moved from the greylist to info@hosted.domain.com whitelist where it remains stored for at least 2 days.

When a message comes to hosted.domain.com from a machine stored in his white list, it is accepted and promptly delivered to his/her mail box. Also the time of the machine record is altered to let it remain in the list for another week. If within a week, no message comes to hosted.domain.com from that machine, its record is removed from the whitelist.

Such a relay-delay of 7 minutes (the period is configurable by the system administrator for all addreses) has proved to be effective in filtering spam and viri, with no false negatives. It filters out messages sent by machines other than legimitate mail servers. The latter are programmed to repeat delivery attempts after temporary failures. Our server, for instance, tries to resend a message in 20 minutes, and then in 1 hour periods for 5 days.

In contrast, spam and viri are usually equipped with their their own sending mechanisms that are:

effectively hiding true identities of their senders, and
NOT trying to repeat any delivery attempts.

They just ignore any signals sent back by accepting servers, no matter whether they are success or failure.