Here's the deleted items folder in Outlook Express showing lots of identified spam. The spam in the bottom right window is missing the pictures because the HTML Modify plugin has been told remove pictures from spam. The Subject lines show the **SPAM mark, the short name for the blacklist which identified the spam and the IP address the spam came from. SpamPal and Outlook Express moved the spam to the deleted items folder automatically.
SpamPal is a spam filter which works by being a mail proxy server. You tell your mail client program to collect mail from the mail server at localhost and to use youraccount@yourISP.com as your account. SpamPal will forward that connection to your mail server and add a **SPAM mark to the Subject line of any mail which it thinks is spam, based on DNS blacklists, regular blacklists, or, with plugins, Bayesian, regular expression or other filtering rules. You use the mail rules to tell your mail client program to move anything containing **SPAM on the subject to a spam folder and/or to delete it.
The DNS Blacklist (DNSBL) screen is the most significant one for filtering for anyone who hasn't installed any plugins. It shows the selection of available blacklists with their selected/deselected state, some information about the blacklist and a link to the blacklist site. The plugins add considerable extra capability to SpamPal but the DNSBLs can block almost all spam.
The blacklists selected here are fairly aggressive. SpamCop (Cop, not Pal) will often block legitimate ISPs for a short time when a spammer is using a stolen account. That risk is countered later, through the use of extensive whitelists of known senders.
If you want to blacklist individual senders you can do it on the blacklist page. It's generally best not to do this for normal spam, relying on the DNSBLs or plugins to catch that. Blacklists are more appropriate for individuals or companies who are bothering you but aren't generic spammers.
The Advanced Blacklist isn't illustrated here. It looks just like the Advanced Whitelist screen, shown later. All mail from any of the IP addresses listed will be marked as spam.
Whitelists are critical to ensuring that mail from your regular senders and mailing lists gets through. A whitelist entry is a golden bullet. Regardless of what any blacklists say, if an address is whitelisted, the mail will not be marked as spam. This is the general whitelist page. Because I use many whitelists with lots of entries I have my whitelist entries in different files. That makes it easy for me to do things like exporting an Outlook Express address book to a file to use my whole address book as a whitelist. The place for specifying those extra whitelist files is described later. Adding known senders to the whitelist also speeds up mail checking, because it disables the DNSBL checks for mail from them. Recommended.
The Advanced Whitelist is a list of server IP addresses or ranges which won't be checked to see if they are spammers. For speed and safety you should add all of the mail servers of your own ISP, possibly taken from Received lines of mail you send to yourself, to this list. As with the whitelists, I have mine specified in extra files, described later. This is really an ignore list, not a whitelist. Servers are ignored but just mentioning one of these IP addresses won't prevent a mail from being marked as spam if another IP address in the headers is that of a spammer.
SpamPal can automatically whitelist senders and servers which regularly send you email. Here's the screen for controlling that.
You can use the never Auto-Whitelist button to list servers which shouldn't be whitelisted. I use that to prevent the Spam Gourmet server from being whitelisted, because spammers occasionally send mail via a forwarding account I have there. Spam Gourmet is also an excellent free anti-spam tool, since it lets you give each company a different email address, making it really easy to cut them off or identify any who spam you.
Part of the display on one line is blanked to conceal private information.
The tagging screen controls how SpamPal marks mail subject lines and headers. It defaults to marking the Subject line with **SPAM** and adding the X-SpamPal header line after other headers. I have it set to give the reason for the spam result as well as the **SPAM** mark. You use the Subject line mark in your mail client rules, telling your client to move spam to a special spam folder and/or to delete it automatically for you.
You can have SpamPal check for updates every so often if you like. Entirely optional and the ability of SpamPal to function will not be harmed at all if you turn these off. I recommend leaving them on and changing the timing if you want less frequent notices. The SpamPal project also uses this to keep a rough count of the number of people who use SpamPal, based on the number of checks for updates which are made. If you're worried that SpamPal might be spying on you, take a look at the source code to reassure yourself. One of the joys of open source software is the ability to be sure, rather than having to trust what a company five mergers and two takeovers later might do.
If necessary you can have SpamPal listen on more ports. You might want to do this if you're sharing SpamPal over a network or for other special purposes.
Some more port settings control the default settings for how much information SpamPal should get when a mail client program asks for headers or bodies. This will be exploited by plugins to help them to improve performance or offer extra features. New in 1.26 so plugins using these options aren't here at the time of writing. Soon. Really. I should know, I'm writing one which does.
Plugins are the second key to how SpamPal filters out the spam. SpamPal has a powerful plugin interface and documentation to allow others to add extra features to SpamPal. Plugins are available for Bayesian filtering, regular expression filtering, censoring web bugs, logging, spam quarantining, extra DNSBL blocking functions and more. Try the core DNSBL filtering before adding plugins - the DNSBLs are very effective and may be all you need.
Shown here is the plugin which eliminates web bugs and pornographic pictures (HTML-Modify), two logging plugins (Logfile and userlogf), three plugins for blocking spam sent from dialup addresses directly to mail servers (the MX-somethings and their debugging versions), plugins which bypass DNSBL caching (uc-something, all disabled - the decreased caching interval in the beta made those largely obsolete) and to quarantine spam (Quarantine and userlogf). Some duplication because I run the plugins I wrote and sometimes cross-check them against the results of other plugins.
The about box for one of the plugins.
The Advanced tab has fine controls for how SpamPal checks DNSBLs and caches their results. It's also the home of the very useful extra black- and white-list setting pages.
Each line is the location of a file containing a SpamPal whitelist. Several different files to keep things organised neatly by topic and make it easy to update them at different times.
Part of the display is blanked to conceal private information.
Files here with lists of RoadRunner mail servers and the mail servers of my own ISP, for speed and to protect against accidental entries for them in DNSBLs.
Part of the display is blanked to conceal private information.
Pointing to one file with some blacklist lines from another place. In a file to make it easy to update.
Part of the display is blanked to conceal private information.
No entries here. You'd add files with blacklists of IP addresses, perhaps for countries or known spamming operations.
The IP configuration screen tells SpamPal which IP addresses to listen on. Mainly useful if you're setting SpamPal up on a network as a shared spam filter.
