The Spam Quarantine Nobody Checks

Mail that arrived and was never seen

A customer emails a quote request with two photographs attached. Your mail server accepts it, scores it as probable spam, and files it somewhere other than the inbox.

Nothing bounces back, so the customer assumes it arrived. They wait a few days, conclude you are not interested, and ask someone else.

Most hosting accounts filter incoming mail this way, and the filter is right nearly all the time. The trouble is the time it is wrong, in a place nobody looks.

Where held mail goes

Depending on the host and the settings, a suspected message ends up in one of several places.

• A spam folder on the server, visible in webmail but often not in Outlook.
• A quarantine kept by the host's filtering service, outside your mailbox entirely.
• A daily digest listing what was held, with links to release it.
• The inbox, tagged, with a word like SPAM added to the subject.
• Nowhere at all, when a setting deletes high-scoring mail outright.

The first catches out many offices. If your computers collect mail by POP, or the folder was never added to the email program, the server's spam folder fills up where nobody will ever see it.

How the filter decides

Filters add up points for features common in spam, such as attachments from a sender they have not seen before, lots of links, a subject in capitals, urgent payment wording, or a sending domain whose own settings are incomplete.

Past a threshold, the message is held. This year filters have good reason to distrust invoices with attachments, since fake ones carrying harmful files are among the commonest spam around.

So the messages most likely to be held are often the ones you most want: a first enquiry with photographs, a new supplier's bill, a customer replying from an unfamiliar address.

One person, every working day

A quarantine only works if someone looks through it before it empties itself, and most delete held mail after a set number of days.

Give the job to one named person and make it part of the morning: a two-minute scan of the folder or the digest, looking for names and subjects you recognise, not reading everything.

If the digest goes to an address nobody reads, such as one belonging to someone who left, redirect it. Cover holidays the way you cover the phone.

Release, then allow

When a real message turns up, release it to the inbox and mark it as not spam if the system offers that. Some filters learn from it.

Then add the sender to the list of addresses that are always let through, usually called a safe senders list or whitelist.

Your accountant, regular suppliers and the address your website's form sends from are worth adding before anything goes missing.

Never allow your own domain as a whole. Spam often forges the recipient's own domain as the sender, and a rule allowing it waves those messages straight through.

Adjust the filter, carefully

If real mail keeps landing in quarantine, the filter may be set too strictly. Most hosting control panels let you raise the score a message needs before it is held.

Change it one step at a time and watch for a week. Loosen it too far and the inbox fills with the spam it was holding back.

If high-scoring mail is set to be deleted outright, consider holding it instead. A filter that is wrong even rarely is then wrong about something you can still check.

Whoever manages your email can also see why a particular message was held, since the filter usually records its score and reasons in the message's headers, the technical lines most email programs hide.

A worked example

A laser engraving service in a light industrial unit engraves wood, leather, acrylic and coated metal: awards, signs, gifts and short runs of branded items for companies.

Nearly every order arrives by email with artwork attached, often a logo as a PDF or a compressed folder of files. Corporate gift orders for the holidays start arriving about now.

Last autumn a company phoned to ask why nobody had answered an order for sixty engraved bottle openers sent ten days before. It was in the host's quarantine, beside two artwork emails from other customers and a supplier's invoice.

The filter had scored new senders with compressed attachments as suspicious, which is reasonable, since harmful files often travel that way. The daily digest listing them went to a former office manager's address.

The fix took an afternoon. The digest now goes to the shared orders inbox, the person who handles quotes checks it every morning, and regular clients and suppliers are on the allowed list.

The contact page now says orders are answered within one working day, and asks anyone who has not heard back by then to phone.

Test what your website sends

Notifications from the website's own forms are a common casualty, because many forms send them in the visitor's name rather than from your domain.

Visitors with Yahoo or AOL addresses are the clearest case. Since last year both tell receiving servers to reject mail falsely claiming to come from them, which is exactly what a form sending in the visitor's name does.

Send a test through the form and see where it lands. If it goes astray, ask whoever looks after the site to send notifications from one of your own addresses, with the visitor's as the reply address.

The counter-case

Some businesses can keep this light. If your mail rarely carries attachments from strangers and the quarantine is usually empty, a look twice a week may be enough.

A business that takes nearly all its enquiries by phone has less riding on the inbox, though suppliers' invoices and customers' replies still arrive by email.

Turning the filter off is not the answer. The inbox would fill with what it holds back, and some of that carries attachments that are genuinely harmful.

Wherever held mail goes, someone should know where it is and look before it is deleted.

This week

1. Find out where your filter puts held mail.
2. Check whether high-scoring mail is deleted outright.
3. Name one person to check it every morning.
4. Send the digest to an inbox someone reads.
5. Allow regular senders, never your whole domain.
6. Test your website's form and see where it lands.
7. Add a reply time to the contact page.

Step three is the whole fix in most offices. The filter is doing its job; what fails is that held mail sits unread until the system deletes it without telling anyone.

When the spam is addressed to made-up names at your own domain, the cause is covered in a catch-all inbox full of spam.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.