Are there plans to improve spam filtering in WorkMail?

0

For the last two years, I have been battling it out with a clever spamming operation that utilizes budget VPS hosts globally. I've worked with hosting providers and organizations like SpamCop to stop some spam, but it always returns, and the level of effort is far more than the return. I've taken a brute force approach using SES IP filter rules to block the worst offenders, and while that is effective for a time, within two months the spammer is back on a different host with new IP addresses. My desktop e-mail clients identify and filter spam effectively, but it's not the case on mobile. For example, Apple Mail requires the user to select and mark each message as spam individually. Desktop clients are configured to filter on receipt and the user rarely, if ever, sees a spam message in their inbox. The rate of false negatives from WorkMail is about 10 messages per day. I'd like to push more of that back to the server side because the messages are clearly spam, and a well-trained, server-side filter should catch them easily. I recently enabled DMARC to see if it helps, but based on what I can see in CloudWatch Logs Insights, it isn't going to do much. Others share my concern, as expressed in other posts from the past several months:

  1. So much spam incoming to WorkMail
  2. Spam volume through WorkMail has significantly increased, with no end in sight
  3. Huge Increase in SPAM
  4. Why antispam in Workmail/SES is garbage?

Here are my suggestions to improve the situation:

  1. Publish SES IP Filter metrics to CloudWatch. This helps me decide if I can remove older filters. Right now, I'm flying blind and reluctant to remove filters because doing so may increase spam volume. If I could see which rules were actively blocking vs. taking up a slot in the quota, it would be very easy for me to prune old filters.
  2. Publish SES logs to CloudWatch. This ties into, and extends, my first suggestion. Logs from SES could give me additional insights.
  3. Give me a trainable, per-user Naive Bayes filter. The best antispam solution I ever used was a defunct project called Dspam. It took a little time to train it correctly, but once it was trained, very little spam made it through and the false positive rate was low, too. bogofilter is another good one.

I think the best solution, but likely most difficult to implement, is the Bayesian filter. I think that would put WorkMail on par with other e-mail providers, and make me less likely to consider migrating. The other two suggestions would help, and would reduce some of my manual effort, but there really needs to be better spam filtering. It is wholly inadequate in its current state.

asked 2 years ago129 views
No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions