This common sense approach to anti-spam includes just about every idea that's ever been tried and actually delivers that most elusive of buzzwords: synergy.

by Alex Goldman ISP-Planet Managing Editor [May 25, 2006]

Woburn, Mass.-based Reflexion was at ISPCON touting a system based on what the company calls "non-disposable e-mail addresses."

For some time, ISP-Planet has been an advocate of disposable e-mail addresses (DEAs): The system that generates a new alias for each transaction, allowing you, the user, to see who sold your name when the spam comes in to, say, me.180solutions@theisp.com.

You can do the same for your snail mail. I get a catalogue delivered to Alex Goldman AMAZON.COM, which is not my actual name.

Theory in practice
For years, we have complained about The Spam Conundrum: although there are only a few ideas for anti-spam systems, there are hundreds of companies offering solutions, many of which resemble each other.

Reflexion seemed to have something new, so we joined the management team for breakfast.

Joseph McIsaac, Reflexion's CTO and the inventor of its technology, says the message theorists have tracked back all spam to a small number of disclosures. As the company's white paper [.pdf] notes, "legitimate contacts never knowingly share your e-mail address with spammers, and spammers only share your address with other spammers, never with legitimate contacts."

The white paper adds a second insight: "it's incredibly difficult to mechanically separate desired mail from undesired, with precision, when all messages arrive to a single address."

McIsaac has a clear idea of what Reflexion does for e-mail users. "We give users the means to make simple and intuitive choices."

It's a multi-layered system, hosted by Reflexion. The one caveat to ISPs is that it does require that they redirect their mail to Reflexion's servers. Scott Barlow, Reflexion director of sales, says a global MX record change is easily automated.

The service's features are:

1. At the top layer is directory harvesting protection. Because the service is hosted, the various domains it is hosting receive the same attack, and statistical sampling can block high volume attacks before they reach the MTA.
   
   
2. The next layer is Reflexion's innovation, the non-DEAs. Depending on the address in the "To:" field, the e-mail is either discarded, passed through to the anti-virus (if the sender is whitelisted), or put through a content filtering engine.
   
   
3. The content filter operates like any other, rejecting spam based on methods that are known to be good but not perfect.
   
   
4. All mail goes through an anti-virus engine before arriving at the user.

Customer feedback taught the Reflexion team that some business addresses, such as sales@, should not have non-DEAs enabled, and the system now allows end users to choose whether or not to use the non-DEA feature.

As a bonus, notes Barlow, ISPs can sell non-DEAs as a value added service while offering the traditional e-mail protection for free for all users.

The non-DEA system tracks what McIsaac calls "address pairs," which we think could create occasional difficulties. Newsletters and retailers will not always send e-mail from the same address to, say, you.amazon@theisp.com, and the system might, as we understand it, reject some legitimate mail from senders who use multiple addresses or several domains.

Of course, once this issue is recognized, the end user can whitelist one or more domains for each non-DEA.

David Hughes, Reflexion CEO, says that the filtering engine behaves according to user instructions. For example, he says that professional services firms like to handle the mail of the principals by sending all mail flagged as spam to an assistant, who can double check it.

Benefits to users and ISPs
Everybody wants to solve the spam problem. Barlow says users love knowing the source of their spam. "There's a level of psychological empowerment, for the user, when the user sees how the spammer got their e-mail."

For version 4 of the software, the latest release, several features were added, Barlow says, including LDAP integration for Microsoft Exchange and the ability to import a whitelist from Micrsoft Outlook. He notes that the website has a more detailed list of benefits to ISPs.

McIsaac's goal was always a system that would be easy to use. Barlow says that user instructions on using the software are simply a few lines of text.

Hughes says that the best benfit of all is, "the more you use it, the more effective it becomes." He points out that for most other anti-spam products, the reverse is true.

Pricing and availability
The product is available now as a hosted or licensed solution.

Pricing for either type of solution starts at $0.99 per user per month, with no up front charge and volume discounts available.

—End