• JSpamFilter is a Java-based TCP proxy intended for use with SMTP mail servers.

  JSpamFilter is inserted into the mail flow and performs both source and content checks on incoming email before that mail gets to your mail server.

  In general, you'll set your existing mail server to listen on port 26, then set up JSpamFilter to run on port 25 (this is the default configuration). Click here for illustrations of some common configurations.

JSpamFilter provides a full suite of content and source analysis tools to examine and analyze incoming mail and a variety of treatment and identification options to subsequently handle and route messages.

The System Administrator managing JSpamFilter selects whether to use the DNSBL-checking features, along with which DNSBLs to use and how to weight the DNSBL-lookup results.

When someone tries to connect to your mail server, JSpamFilter compares their IP address against one or more DNSBL(s) configured by doing a DNS lookup with the reversed IP address plus ".bl.spamcop.net" (name varies by DNSBL). If each IP address lookup fails (the source is not a known spammer), then a connection is established from JSpamFilter to port 26, and the connection is allowed to proceed.

Depending on the settings made by the System Administrator, if the remote sender is on one of the lists, their connection is refused or tagged to identify it as likely being spam email. The selection which DNSBLs to use and how to weight their results is customizable. Blacklisted addresses receive a reply similar to the following:
550 mail Service not available due to [servicename] blackhole

• Content analysis can be performed using direct keyword and keyphrase searches along with advanced probabalistic and rule-based analyses to combine and weight analysis results.

  Content checks also include full header analysis, along with script and mark-up element analyses.

  Using probabalistic and statistical checks, a score is constructed based on the content of the message.

JSpamFilter provides a variety of treatment and identification options to subsequently handle and route messages.

• Based on settings made by the System Administrator, email messages are handled in several ways.

  • Forwarded to the end-user untouched
  • "Tagged" as likely being spam, but forwarded to be handled by the end-user's email client. Tagged mail can then be routed to a particular folder in the end-user's email client (e.g., Microsoft Outlook, Lotus Notes, Novell Groupwise Client, etc.) for later examination.
  • "Blocked" prior to arriving at your mail server. Blocked mail can be either refused at the gateway or routed to a global "garbage" email account.

  The mail handling options are determined by the thresholds set by the System Administrator, and the choices in analysis options.

  By using a global garbage email account, the possibility of "false positives" (i.e., messages accidentally rejected) can be eliminated.

All of the parameters controlling JSpamFilter's behavior can be adjusted by the System Administrator to best suit your needs.

• All parameters can be set by the System Administrator:

  • Thresholds are adjustable: a "tag" can be upgraded to a "block" and a "block" can be downgraded to a "tag".

  • Weights are adjustable: some key words and phrases are more "spammy" than others and are more likely to occur in legitimate email in some situations as opposed to others (e.g., a real-estate office receives legitimate email with mortgage rates).

  • The System Administrator can choose whether or not to use DNSBLs, which DNSBLs to use, and how to weight the results from the DNSBL look-up.

  • Mark-up and script thresholds are adjustable.

  • DNSBL look-ups can be done before or after content checks.

  • The results of the content analysis with the DNSBL look-up are combined using probabalistic and other mathematical algorithms to create a score on which the treatment of the message is based.

JSpamFilter also helps you prevent abuse of your mail server.

• JSpamFilter also detects and stops malicious spammers from using your server as an "open relay", whereby they can abuse your server to send their junk mail. See the manual for more details. Remote clients can still send messages by using SMTP AUTH relay over-ride.