My Pet Peeve: Using Rules to Fight Spam

Color me clueless, but I just can not understand why people are so fixated on using rules to delete spam. It's time consuming to keep the rules updated because spammers keep changing their addresses (often using fake addresses from legitimate domains) and use creative spelling for their products. You just can't win at this game using rules like this, but you can waste a lot of time trying.

A user trying to use rules to delete spam recently had this to say:

"The messages I want permanently deleted are remaining in the junk folder, instead of being deleted upon receipt."

Why is it so important that your rules delete spam? What is wrong with letting the junk filter drop them in the junk email folder and empty it regularly? If you set up autoarchive to run on the folder and delete mail xx days old, it'll keep the junk folder cleaned out for you, or just right click on it every now and again and empty it. This is assuming you can ignore the unread message count and bolded folder name. I can, but many people just can not ignore a folder containing unread messages, so they'll toy with rules for hours, trying to delete as much spam as possible.

Note that the behavior of the rule is correct and this is how Outlook 2003 (and newer) now works. In Outlook 2003 RTM, rules run first, before the spam filter, and anyone who had multiple accounts and used rules to move the mail to other folders found the spam was moved too. Because most people felt the spam filter should act on the mail first, Microsoft changed the order so that junk mail is filtered out before rules run on the remaining messages.

Blocked Senders List

Another problem area for many users is the blocked senders list. Users demand the ability to add domains to the blocked list from the right click menu or they want to select multiple messages and have the senders or their domains added to the blocked list. Once again, I have to ask "Why?". Adding the domain of the latest spammer to send you medicinal emails is not worth the effort; spammers are always one step ahead of you and will use a new domain tomorrow. Fighting spam like this is a waste of resources.

Your Safe or Trusted senders lists should be much longer than the list of blocked addresses and domains. The blocked list should only contain the addresses of legitimate but annoying senders. For example, my blocked lists contain the address of a person who forwards me a lot of things he thinks are cute and the domains of a couple of businesses that send newsletters. These are newsletters I'm either too lazy to remove my address from, don't know what address I used when I signed up and can't get removed until I remember, or their remove procedure doesn't work. My safe list is very long - any address or domain that sends mail that is wrongly moved to the junk email folder is on the safe lists.

Another reason for keeping the lists small is that Outlook 2003 (and newer) limits the size of all safe and blocked lists to about 2000 addresses. Other versions allow larger blocked lists, but resources are affected by bigger lists, so smaller is better here too.

Using a rule to permanently delete messages

Another user had this problem:

"Microsoft Outlook is deleting all kinds of emails after setting up a rule, these are emails that DIDN'T include what I put into the rule. I set up the rule to permanently delete them too... those emails were very important"

Why is it so important that the messages get deleted permanently? What is wrong with moving them to the deleted folder and either using autoarchive to keep it cleaned out or set Outlook to empty deleted items on Exit? Using autoarchive configured to delete mail more than a couple of days old gives you plenty of time to look for misdirected messages too.

Ignoring the fact that spammers use many creative ways to spell the words you are most likely to filter out, making most subject or body rules useless, a subject or body contains type of rule doesn't work well with HTML email and especially with HTML formatted spam. Spammers split the words in the HTML code using comments, so what you see rendered in the message not what the filter is looking for. It turns out this users rule was configured with letter combinations that are found in many commonly used words. To filter for whole words, you need to use a space before and after the word, otherwise Outlook looks for the letters in every word. Not testing the rule by assigning categories or moving the messages to another folder was a big mistake.

Since blocking senders and using rules to filter words are not good methods to manage spam, what is the best way to remove it?

For starters, most spam (and all viruses) should be removed from the mail stream before the message ever reaches user's inboxes, especially in a corporate environment. Employees are paid to work, not tweak rules to remove spam. When this is not possible, such as on ISP provided email accounts, a client side anti-spam filter is better than rules.

If you use Outlook 2003 and newer, get the latest update for the spam filter and set it on High. Microsoft has been releasing updates monthly - the latest update came out August 22. If you forget to check for updates, use the new Microsoft Update service to keep both Windows and Office automatically updated. Use the safe list to keep false positives low.

Users of older versions of Outlook can try some simple rules, including Sue's low maintenance rules, along with rules for blank senders and blank subject lines. Rules looking for words in the header can help with spam using non-English character sets - use the character set name as it appears in the header, for example, look for 'iso-2022-jp'. Of course, if you get legitimate email using this character set, this won't work, but for the average user, it works well. If you get mostly spam to one address, create a rule to delete mail sent to the address and add exceptions to the rule for the mail from specific addresses or meeting specific conditions. If simple rules like these are not enough to control your spam, you need to get a real anti-spam filter - there are a number of excellent filters available for both Outlook and Exchange server.