ITS Documentation

U-M is going Google! If you use the ITS IMAP email service, you will switch to a U-M Google account sometime during 2012. See the google.umich.edu website for details, including go-live dates. This document will remain available until all IMAP email users have moved to Google Mail.

Using SpamBox for E-Mail Spam Filtering

S4314 • November 2012

This document provides instructions for using ITS's content filtering tool for spam, SpamBox. SpamBox keeps most spam messages out of your INBOX by filtering them into a separate folder for you, where you can do a quick check for any misidentified messages before deleting the spam. SpamBox works with the ITS IMAP e-mail service only; it does not work with the ITS Exchange E-Mail service or with the U-M Health System Outlook mail service or Google mail.

Table of Contents

What SpamBox Does

SpamBox checks your incoming messages as they come in to the ITS e-mail servers. It uses Bayesian and other statistical algorithms to compare the content of the messages (broken down into text strings called "tokens") to the information in a "dictionary" that it maintains. It tags messages it suspects to be spam (by adding some text to the message header).

Diagram showing how SpamBox works. Incoming messages are tagged on the ITS e-mail machines. Then a server-sed filter filters the messages into your INBOX or SpamBox folder as appropriate.

SpamBox is very accurate, but it will occasionally make a mistake when figuring out which messages are spam and which are innocent. For example, when spammers try a new technique, SpamBox may not recognize the messages as spam until it has been programmed to "learn" what they are. Also, if an innocent message has characteristics of mail that is typically spam, such as HTML code or embedded images, it may be misidentified as spam.

Table of Contents

Turn SpamBox On Via the Web

Requirement

  • You must be using the ITS IMAP e-mail service. SpamBox is installed on the ITS e-mail servers, so it can only work with ITS-provided mailboxes. (Note that SpamBox does not work with the ITS Exchange Service, Google mail, or the U-M Health System Outlook service.)

WARNING! Some U-M departments provide their own e-mail services. Before turning SpamBox on, please check with your department's information technology help desk to see if you are currently using one of these services.

Using the SpamBox Setup Wizard

  1. Go to the Tools to Reduce Spam page on the Spam Busters website.

  2. Click the SpamBox link.

  3. Log in with your uniqname and UMICH password.

  4. Select the e-mail program you use most, then click Continue.

  5. Depending on which e-mail program you selected, you may be asked whether your program is set up for IMAP or POP. This will allow us to tailor SpamBox for your e-mail setup.

    IMAP users will have a SpamBox folder created for them on the ITS mail server, as well as a filter to work with it.

    POP users will need to create their own SpamBox folder and a filter or rule to work with it using their e-mail program. See Creating POP Mail Filters/Rules to Work with SpamBox (S4324) for details. For help figuring out whether you are using IMAP or POP, see How to Tell If You Are Using IMAP or POP for Your E-Mail (S4322).

    IF YOU USE MULTIPLE MAIL PROGRAMS: As long as all the mail programs you use are using IMAP, everything will work fine.

  6. You'll be notified that SpamBox has been turned on for your ITS e-mail mailbox.

When you turn SpamBox on for your ITS IMAP e-mail mailbox, three things happen:

  1. SpamBox mail tagging is turned on for your incoming mail.

  2. A server-side filter is created to filter the tagged messages.

  3. A SpamBox folder is created inside your mailbox as a repository for messages tagged as likely to be spam.

NOTE TO POP USERS: If, when you turn SpamBox on, you indicate that you use a POP e-mail program, only the first of these three things happens.

Table of Contents

Your New SpamBox Folder

Once SpamBox has been enabled for your ITS IMAP e-mail account, you will notice a new folder/mailbox in your folder list called SpamBox. Any incoming messages identified as likely to be spam will be put there. You will need to regularly look in this folder to check for any non-spam messages mistakenly placed there and to delete the spam messages.

If You Accidentally Delete the SpamBox Folder

If you should inadvertently delete the SpamBox folder, you can create a new one yourself. Be sure to name it SpamBox, making the name all one word and matching the capitalization and lower case letters exactly. The server-side filter will not be able to put your suspected spam messages in the folder if the folder name is different in any way.

Tips for Making Your SpamBox Folder Appear Using Various E-Mail Programs

If you do not see your SpamBox folder after turning SpamBox on, you may need to tell your e-mail program how to find and display it. Here are some ways to do that:

  • Quit and reopen your e-mail program.

  • Look for a Refresh Mailbox List command and use it.

  • Look for a Synchronize Folders command and use it.

  • Look for a Subscribe command and use it.

Apple's Mail Application (IMAP)

  • You may need to expand the remote/global folder list. If you have an icon in your mailbox folder list that looks like a globe with an @ symbol, try expanding the list to see your SpamBox folder.

  • Sometimes rebuilding causes the folder to appear. From the Mailbox menu, select Rebuild.

  • Some Mail users have reported that if you are using an old version of Mail, you may need to delete your old Mail preferences, set up new ones, and restart your computer.

Outlook (IMAP)

You may need to subscribe to the SpamBox folder to see it.

  1. In the Folder List on the left side of your Outlook window, right-click your IMAP mailbox.

  2. In the folder list that pops up, left-click IMAP Folders.

  3. In the IMAP Folders box, click the Query button. A list of all your IMAP folders will be displayed.

  4. In the list of IMAP folders, click the SpamBox folder. (It will not have a yellow folder icon next to it.)

  5. Click the Subscribe button to the right of the SpamBox folder name. (This will cause the yellow folder icon to appear next to the folder name.)

  6. Click OK.

Outlook Express (IMAP)

You may need to subscribe to the SpamBox folder to see it.

  1. In the Folder List on the left side of your Outlook Express window, click your mail.umich.edu mailbox.

  2. Click the IMAP Folders button.

  3. In the Show/Hide IMAP Folders dialog box, click the Reset List button.

  4. In the list of folders, double-click the SpamBox folder name so that a folder icon appears to the left of it.

  5. Click OK.

Table of Contents

It Is Important to Check Your SpamBox Folder Regularly

Check your SpamBox folder regularly for these reasons:

  • To check for messages that might have been misidentified as spam.

  • To delete the spam messages and keep your mailbox size manageable. Messages in your SpamBox folder do count toward your mailbox size quota.

Table of Contents

Keeping Mail from a Particular Address Out of Your SpamBox Folder

If you would like to be sure that mail from a particular address (perhaps that of your parents or your spouse) will never get mistakenly placed in your SpamBox folder, you can do this by adding that address to your Accept List. Then all mail from that address will be put in your INBOX regardless of whether SpamBox "thinks" the mail looks like spam or not. See this document for details:

Table of Contents

Turning SpamBox Off

If you later decide that you do not want to use SpamBox, you can turn it off.

  1. Use your web browser to go to the Tools to Reduce Spam page on the Spam Busters website.

  2. Click the SpamBox link.

  3. Log in with your uniqname and UMICH password.

  4. Click the Turn Off SpamBox button.

Table of Contents

Reporting SpamBox Errors

You do not need to report the errors that SpamBox makes. If, however, you would like to help us continually improve its ability to identify spam, here are instructions for reporting errors.

IMPORTANT! To report errors, you must use the web-based web.mail.umich.edu. When you turn SpamBox on, spam-reporting links are added to web.mail.umich.edu for you.

To Report Spam in Your INBOX

  1. Open your mail using web.mail.umich.edu (http://web.mail.umich.edu).

  2. Open the message, then click the This is Spam link. Note that this link is only available inside your SpamBox folder; it does not appear in your other folders.

    Screen shot showing the This Is Spam link.

  3. You will see confirmation that the report has been made.

To Report Innocent Mail in Your SpamBox Folder

  1. Open your mail using mail.umich.edu (http://mail.umich.edu).

  2. Open the message, then click the This is Not Spam link.

    Screen shot showing the This Is Not Spam link.

  3. You will see confirmation that the report has been made.

IMPORTANT! Web.mail.umich.edu can only recognize one folder for spam mail. If you change your web.mail.umich.edu preferences to select a folder other than SpamBox for your spam folder, please be aware that the This is Not Spam link will no longer be available inside your SpamBox folder. Instead, that link will appear inside whatever folder you designate as your spam folder.

Table of Contents

Additional Resources

Visit ITS's Information System to obtain ITS computer documentation and other resources. A list of relevant documents follows:

The ITS Service Center provides a variety of computing help resources.

For further help with this or any other topic, call 734-764-HELP [4357] or submit an online service request.

Table of Contents

Appendix A: Frequently Asked Questions

Why can't I see my SpamBox folder?
There are two possible reasons for this:

  1. The IMAP e-mail program you are using may need to be prompted to look for new folders. See Tips for Making Your SpamBox Folder Appear Using Various E-Mail Programs earlier in this document.

  2. If your e-mail program uses POP rather than IMAP and you are therefore downloading your mail to your computer, you will not see a SpamBox folder. This is because SpamBox cannot create a folder on your local computer. See Creating POP Mail Filters/Rules to Work with SpamBox (S4324) for details.

Can SpamBox be fixed to filter a specific address/keyword/domain? Why did this message get identified as spam and that similar message go into my INBOX?
SpamBox is not a keyword filter, so it does not decide whether a message is spam based on the sender's address or the presence of a particular word or phrase. Instead, SpamBox breaks each incoming message up into small character strings called "tokens" and then uses Bayesian and other statistical algorithms to compare the message tokens against tokens in its spam and not-spam dictionary. Based on this analysis, it calculates the probability that each token, as well as the chains of tokens, are spam, then determines the probability that the entire message is spam.

If you'd like to learn more about the Bayesian approach to spam filtering, these web pages are good resources: http://paulgraham.com/spam.html and http://paulgraham.com/better.html

When spammers try a new tactic, SpamBox may miss some of the new spam that is sent until information about it is added to its central spam information. That information is updated regularly.

The directory forwards my mail to my ITS mailbox and to my Comcast (or other) address. Why is all the spam still going to my Comcast address?
The message is sent to Comcast before SpamBox sees it. Here's what happens: Mail addressed to uniqname@umich.edu comes in to the mail gateway machines, which get your forwarding address(es) from the directory. The directory has both your campus address and your Comcast address. So, the gateway forwards a copy of the message to both addresses.

One copy goes off to your Comcast address, and the other goes to the machine where your U-M mail resides—one of the ITS mail servers. SpamBox is installed on that machine. Therefore, it can only work on mail that goes to your ITS mailbox.

Can I make Apple's Mail Application tell me when there are messages in my SpamBox folder?
Mail does not always "count and make bold" the SpamBox folder. That means that Mail will not alert you when there are new messages in that folder. You can click the folder name to force an update, or check the folder regularly.

Table of Contents

Appendix B: The Software Behind SpamBox -- DSPAM, Ingo and Sieve

The spam-identifying software behind SpamBox is DSPAM. DSPAM is open source software available to the university at no charge. ITS staff members participate with others in the open source community to continually improve DSPAM.

Technical details about DSPAM are on the Nuclear Elephant website.

DSPAM is set to tag mail as either spam or innocent. It works in conjunction with server-side filters to have the tagged mail sorted into your INBOX and SpamBox folder. The SpamBox setup wizard uses Ingo software (which is actually an application inside IMP, which is the software behind the web-based mail.umich.edu) as an interface to the Sieve mail filtering language to create a mail filter on the ITS mail servers.

Technical information about IMP and Ingo is available in the Projects section of the Horde website. The Horde Project is responsible for this open source software.

Table of Contents