Security Tools News & Tips

Wikipedia estimates that 80% to 85% of the incoming mail is “abusive email”. I had a chance to check what percentage of email in one of our domains contain spam and virus.

Background
This Email Server serves only one domain, has around 150 accounts, but only around 50 are active. It was running without any anti-virus or anti-spam protection until last week. Last Monday, on 8th Jan we implemented a demo unit of Barracuda Spam Firewall, and this is what I found.

What does the the email Statics say

Unique Recipients: 2239. This means the spammers are just bombarding the server by sending emails to existing and non existing users.
Total Received: 214,232 (Total number of emails received in 4 days)
Allowed: 8,225 (Around 3.8% of the emails are good emails)
Allowed: Tagged: 7,086 (Around 3.3% of the emails were tagged for possible spam and users reported that all of the tagged emails were spam)
Blocked Virus: 1,293 (Around 0.6% of emails contain viruses and worms)
Blocked: 197,628 (92.2% of the emails were Spam emails)

After combining Blocked, Tagged and Virus emails, we found around 96% of the total received emails to be abusive emails (either Spam, Virus or Worm). Only around 4% of the emails were good emails.

Barracuda Admin Dashboard, showing the overall Status of the Email activity

Detailed Hourly and Daily Mail Statistics

Qmailmrtg graph, showing Weekly Queue size from email server itself

Before implementing the Barracuda, this server always had 2000+ emails in it’s queue for remote delivery, that was mainly due to the spams sent with non-existing return address. After the implementation of Barracuda Firewall on Monday, it dropped dramatically to average of around 200 emails in remote delivery queue .

Qmailmrtg graph of the Local/Remote SMTP Concurrent Connections

Before the implementation of Barracuda, the average concurrent remote smtp connections used to be around 35 because of trying to bounce back the emails sent to non-existing users. After the implementation of Barracuda Spam Firewall, the remote concurrency has dropped to average of 7.

Conclusion
As you can see from my results, how much of a garbage and really harmful stuff can end up in the users Inbox. So, some sort of Spam and Virus protection is a must for every email server. There’re many commercial products like Barracuda to solve this problem. But if you want a free solution, Spamassassin plus Clam Antivirus is the best choice. It’s popular, it’s free and it’s also very effective.