InfoStorm 2.3 is out. This release is about catching what used to slip through, and making sure your own outgoing mail is trusted by Gmail, Microsoft and Yahoo. It installs from the web admin under Appliance → Updates; no reinstall is needed this time.
Teach the filter
The filter has always learned by itself from mail that is clearly spam or clearly fine. Now your users can help with the unclear cases:
- Spam that got through: forward it as an attachment to
spam@your filter’s address. - Good mail that was wrongly tagged: forward it the same way to
notspam@. - The quarantine teaches too. Releasing a message tells the filter it was fine, and the new Delete as spam button tells it the opposite.
The Spam page shows how much the filter has learned. It starts using what it has learned after it has seen 200 spam and 200 normal messages.
Stopping fake mail from your own domain
A classic fraud is mail that appears to come from your own boss or accounting department: “please pay this invoice today”. InfoStorm now notices mail claiming to be from one of your own domains that wasn’t sent by that domain’s servers. Such mail gets extra spam points, so together with almost any other warning sign it ends up in the quarantine. Senders you have allowed are not affected.
DMARC
Many organisations, banks among them, publish a DMARC policy saying “reject mail that fakes our address”. InfoStorm now checks it. Mail failing a reject policy is treated as spam.
DKIM signatures on outgoing mail
The big providers increasingly expect outgoing mail to carry a DKIM signature. Under Sending → Outgoing filtering you can create a key for each of your domains. InfoStorm shows the DNS record to publish and starts signing as soon as it finds it. It also checks every night that the record is still there.
More sources, and its own DNS
- A DNS resolver of its own. InfoStorm now looks things up itself. That matters because blocklists like Spamhaus refuse lookups that arrive through big shared DNS services. The Mail server page shows whether the blocklists are answering.
- Spamhaus DQS for SpamAssassin. With a DQS key, SpamAssassin also checks the links in a message and newly registered domains, a strong sign of phishing.
- Sanesecurity signatures for ClamAV catch phishing and scam mail the standard virus signatures miss.
- Pyzor compares each message with what other mail servers have reported as spam.
Some well-known sources are only free for small or non-commercial use: the KAM rules, URIBL/SURBL, Razor and DCC. They’re included but switched off, and marked on the Spam page, so you can turn them on where your use is covered.
Updating
Go to Appliance → Updates → InfoStorm and click Install. Your current version is saved first, and if anything goes wrong it is put back automatically. Afterwards, have a look at the Spam page: Review & reset shows which new recommendations differ from your settings.