Stamping Out Spam

It clutters your e-mail, slows your PC, and worse -- but plenty of weapons can combat spam. Here's how to choose the best one for you

There are millions of ways to spell Viagra. Carsten Arnold tried them all in an effort to stop spammers from sending junk e-mail to Canada Wide Magazines & Communications, the $25 million company he works for. Then he gave up. "Some days I wish I could just unplug the whole bloody Internet," fumes Arnold, information-technology manager for the 100-employee publisher in Barnaby, B.C. Those unwanted commercial e-mails for everything from porn to low-interest loans are more than tasteless nuisances. They slow business. "It's a huge load on our e-mail server. It takes forever for e-mails to come through or go out," says Arnold, estimating that the clog slows e-mail correspondence by at least an hour a day. Worse, spam can be destructive: It's the primary means to spread viruses between computers.

There are a growing number of weapons available to combat the spam tsunami. About 40 companies offer antispam tools and services, according to Gartner Group, a Stamford (Conn.) research firm. Most tools to fight spam fall into three categories: software, hardware, or managed services that clean up your e-mail for you. A lesser-known option, called challenge-response, works very well but is probably suitable for only a small range of companies. Choosing which option is right for your business depends on your needs, budget, and technology expertise.


Antispam software tries to distinguish between legitimate correspondence and junk by testing every incoming message against thousands of rules. The software then generates lists of quarantined messages so your tech staff can ensure no "real" e-mail has been trapped by accident. The software is automatically updated to stay current with the latest spam and virus exploits.

But it's not plug-and-play. At the very least, the programs require familiarity with Microsoft's Exchange e-mail server and filters, making them a good choice for companies with a dedicated technology manager, says Joel Snyder, a senior partner with technology-testing company Opus One in Tucson. "These systems usually take two to three days to get going and require one to two hours of a system administrator's time per week," says Snyder.

That system administrator will be customizing the software's filters to your business. If you run a radiology consulting firm, for instance, the word "breast" doesn't necessarily indicate spam. The filter could be adjusted to allow e-mail with the word "breast," at least in association with other words such as "tumor" or "MRI." When the system is working well and calibrated to your company's requirements, checking the quarantine lists becomes both easier and less important.


Companies with more limited information technology expertise might consider an antispam appliance. This is a relatively idiot-proof enclosed box that sits between your firewall and your e-mail server. It plugs into your local network via a simple Ethernet connection. Like software, appliances are automatically updated by their vendors.

Most appliances let you choose between a few different levels of pickiness (they call it "configuration"), so you can determine how ruthless the appliance should be in designating e-mail as junk. Spam gets quarantined, and the appliance automatically blocks the transmission routes of known spammers.

Scotty Carreiro, IT director for 30-employee, $10 million Seattle-based, switched to an appliance after being forced to rewrite filter rules for his antispam software with each new wave of spam and viruses. "The human cost of modifying code every time was getting out of hand," Carreiro says. He now uses an appliance from Cupertino (Calif.)-based Barracuda Networks. Its Web interface allows the system administrator to customize, rather than rewrite, the filters. With a little work, Carreiro got the box to block more than 90% of incoming spam.

A big advantage of using an appliance is flat-rate pricing -- one box manages spam for your entire network, regardless of how many employees you have. But you'll still pay monthly fees for updates.


The simplest solution is to outsource the spam wars to a managed-services company. You don't need a techie to do this. With a small change to your Domain Name Server setting, you can route your e-mail directly to the managed service. That company will scrub it for spam and viruses, then send it along to you nearly instantaneously. It costs about $25 per employee per year.

At Actify, a $7.5 million San Francisco design-software company, the deluge of spam was hurting productivity. "It would take a good hour [a day] for me to farm through what was good and bad [e-mail]," says Lynne Saunders, vice-president of worldwide marketing. Actify was paying its IT consultant "thousands" of extra dollars for the time he spent dealing with spam, says Saunders. Still, many of the company's 32 employees were missing important messages.

In June, Actify hired Redwood City (Calif.)-based Postini, one of the oldest managed-services companies, for $3,500 a year. Now, Saunders receives only the occasional junk e-mail. She particularly likes that employees can customize their own filters to suit their e-mail requirements, which most outsourcing solutions don't allow. "Everyone loves it," she says.

One of the downsides of an outsourced service is that if anything dramatic should go wrong, you won't have immediate access to your e-mail servers. Of course, if you're not comfortable running your own e-mail server in the first place, this wouldn't be an issue.


A final option, and a less common choice, is a challenge-response system from vendors such as Seattle-based Spam Arrest and Mail Blocks of Los Altos, Calif. As with the managed services, the first step is to change your Domain Name Server setting to route incoming mail through the services' gateways. When an e-mail is sent to a protected address for the first time, the sender must type in a code that a computer can't manage without human help. The e-mail is delivered only when the code is received. This technique opens the gates to individually-written messages and blocks spam, which is almost always automated. Once a sender has been accepted into the system, entry codes are no longer required. The cost is relatively low -- about $3 per month per user -- and results are stellar. But the model hasn't gained much traction with businesses, mostly because companies don't want to put up any roadblocks to communication from potential customers. Communication, after all, is what e-mail is supposed to be used for in the first place.

By Randy Barrett

    Before it's here, it's on the Bloomberg Terminal.