Over the years, many different approaches to filtering and blocking spam have been implemented. Some are now obsolete, some are still used, and yet others--such as PrismEmail--use a combination of various approaches.

This page will explain the various approaches to blocking spam so that the user completely understands each approach, its strengths, and its weaknesses.

Keyword filters are the simplest of spam filters.

A keyword filter simply looks for specific words--called keywords--in an incoming message. If the keyword is found the incoming message is assumed to be spam and is blocked. For example, the words "LIMITED TIME OFFER" may be a keyword. When an email arrives the system looks through the email for these words. If the words are found the system assumes the message is spam and blocks it.

Of course, keyword filters work by having someone look at spam and recognizing keywords that often appear in spam but don't appear in good email. This is time-consuming and the spam filter is always one step behind the spammer. If the spammer comes up with a new way to spell Viagra (i.e., "V!agra") then that must be added to the keyword filter--but it probably won't be added until at least one spam gets through. Also, spammers can just mangle or misspell words to get them past keyword filters.

Another problem with keyword filters is the high risk of false positives. While "LIMITED TIME OFFER" seldom appears in real email, it could. If the system automatically discards a message just because these words were found it could easily discard good email. Additionally, what might be spammy words for one user might not be spammy for someone else. A "one size fits all" type of approach is necessary and isn't very effective.

One area where keyword filters are useful--and where PrismEmail implements them--is in blacklisting known spam websites. For example, if we detect a spam that references the website iamspamsite.com then we will add that to our keyword filters. Since there is virtually no chance that a real message between real users will be discussing any given spam website there is very little risk in rejecting such messages.

Keyword filters, then, are not sufficient as the only line of defense against spam. However, limited keyword filters--especially those that detect known spam websites--can be useful at catching additional spam that might otherwise get through.

Challenge/Response filters have become popular recently. They work by checking who sent every email and, if the sender is authorized, passes the email to the destination immediately. If the sender is unknown-- which is the case the first time anyone sends you an email or when a spammer sends you spam--the system automatically sends back a "challenge" to the sender. This challenge normally asks the sender to click on a link to a webpage which the system uses as "proof" that a real person sent the message. At that point, all future messages from that sender will be allowed through. A sender, in theory, only has to go through this "challenge" process once. The benefit is that spammers currently aren't going to respond to these challenges so the user will see a drop in the amount of spam they receive.

This approach is seriously flawed, however, and is downright irresponsible. Most spam that is sent is sent with forged headers. This means a spam might appear to be from someuser@yahoo.com when, in fact, it was sent by somebody else. Someuser@yahoo.com is completely innocent but just had the bad luck of having a spammer uses their address as the "return address." As a result, when one of these spams hits a challenge/response system it automatically results in a challenge being sent to someuser@yahoo.com even though that user didn't send the original message. The user of challenge/ response will see his spam go down, but he's essentially spamming one person every time he blocks a spam. This is just irresponsible and solves one person's spam problem by creating spam problems for hundreds of others.

Another disadvantage is that it depends on the sender to take some action for it to work. Users of this system are essentially asking others to solve their spam problem for them. Many people will just ignore the challenge they receive (perhaps because they resent being asked to do the work to solve someone elses spam problem) and so the message they sent will never be read by the intended receiver. Others might think (somewhat correctly) that it is just spam and delete it with the rest of the garbage--again, the message will not be read in that case. Other times the user may have email access but may not have access to the web because their employer blocks such access--they'll have no way of clicking the link.

Challenge/response is a very poor response to spam. It assumes that the sender address is always accurate but, in reality, spammers almost never use a valid email address so the user of challenge/response ends up spamming innocent victims of spam. As a result, challenge/response cannot be considered a valid technical solution for spam. It creates as many problems as it tries to solve.