Messaging Gateway

 View Only
Expand all | Collapse all

Upgrading from Symantec Mail Security for SMTP Gateway version 3.1.0.29

  • 1.  Upgrading from Symantec Mail Security for SMTP Gateway version 3.1.0.29

    Posted Dec 24, 2007 02:03 AM
    One of my customers is still using Symantec Mail Security for SMTP Gateway versoin 3.1, I am considering to do a upgrade for them to version 5.0.1, I have some questions regarding version 5.0.1.

    In the datasheet, it paints such a nice picture that it "can detect spam with a greater than 97% effectiveness rate and can prevent false positives with a 99.9999% accuracy rate", BUT, with the need to purchase "Symantec Premium AntiSpam".

    I would like to know, how good is version 5.0.1, comparing to version 3.1, without purchasing "Symantec Premium AntiSpam"? Can it learn the "patten" of spams and automatically "quarantine" spams? Or can it get spam database feed from the Internet (Is there any free database feed in the first place?)

    Thanks, and Merry Christmas!


  • 2.  RE: Upgrading from Symantec Mail Security for SMTP Gateway version 3.1.0.29

    Posted Dec 27, 2007 12:32 PM
    Patrick,

    I don't have the SMS for SMTP, but from what I understand, it is very similar to the SMS 8200 Appliances I use.  As to the specific version numbers, I don't know how they match up with the appliances, but in general, the newer versions appear to add a few new features (IM filtering for example), update the web GUI, and tweak performance.  It may introduce a new version of a particular component.

    SMS doesn't "learn" from your SPAM.  It uses a database of spam signatures from Symantec that is built from several sources, one being customer submitted SPAM samples.  It could be that Symantec aggregates these submissions and trains it's database from that pool, then distributes it out to everyone.

    About the only third party data feeds you can configure are DNS blackhole lists, which I strongly recommend you research and understand before using, but definately use them.  These lists alone would block about 90% of inbound spam.  Some of them are available for free, but most offer a commercial feed for businesses.  Too many checks could get you blocked from some.  You do have to occasionally deal with legitimate senders being added to the list, but adding them to the allowed senders generally handles this.

    Ideally, set up an internal blacklist DNS server, configure it to update from the corporate feeds, and direct your SMS blacklists to that.  Performance is MUCH better and you'll have better data to report from, just not in SMS.

    From my experience, once I'd tweaked it to our usage, my company received very little SPAM in the end-user's mailbox.  We don't subscribe to the premium antispam services, just the basic.  From what I can tell, the premium gives your more dictionaries and patterns for scanning the content of the emails and it may help, especially with the bursts of new SPAM that occasionally gets through.  I just haven't seen a need for it.

    Hope it helps