A SpamAssassin alternative that reads for intent

Rules and scores need constant tuning

SpamAssassin's approach was designed more than 20 years ago, and it still works the same basic way. Each rule looks for a pattern and adds points, and a message over the threshold is spam. Rules are written for spam that has already been seen, so new wording has to be caught by a new rule.

Many of those rules look for a specific phrase. These four come from SpamAssassin's standard rule set. Each one adds points when the wording matches, and does nothing when the same idea is written another way.

body DEAR_FRIEND /^\s*Dear Friend\b/i

body GUARANTEED_100_PERCENT /100% GUARANTEED/i

body UNCLAIMED_MONEY /\bunclaimed\s(?:assets?|accounts?|mon(?:ey|ies)|balance|funds?|prizes?|rewards?|payments?|deposits?)\b/i

body FREE_QUOTE_INSTANT /free.{0,12}(?:(?:instant|express|online|no.?obligation).{0,4})+.{0,32}\bquote/i

Getting good results means watching the scores and adjusting them for your own mail. On a busy server, that becomes a regular job for someone.

Bayesian filters are easy to work around

SpamAssassin's Bayesian filter counts how often words show up in spam and in good mail. Spammers get around it by padding messages with ordinary words, misspelling the words filters look for, or putting the text in an image. A Bayes database also needs training, and it gets less useful when nobody keeps it up.

Here's an example we wrote to show the first two tricks. The reader sees a short warning about their mailbox. The filter also reads a paragraph the reader never sees.

1. Misspelled words. Zeros and ones replace letters in the words a filter has learned to count as spam, so it sees words it may never have counted before.
2. The request. The link asks the reader to sign in. This is the part the sender cares about.
3. Hidden filler. A paragraph of everyday words in white text. People don't see it, but the filter counts every word, and words like these mostly show up in good mail.

Neither trick changes what the message wants, and that's what SpamFoo looks at.

SpamFoo looks for the request behind the words

A scam that wants a payment or a password still wants it after the wording changes. SpamFoo's models read the message together with its links, its sender's history and its SPF, DKIM and DMARC results, and judge what the message is asking for. There are no scores to tune.

Learning without a database to train

When a user marks a message as spam or rescues one from junk, SpamFoo applies it to their mailbox right away. There's no training job to run. Each correction also helps improve the models that every SpamFoo installation uses.

Phishing protection and sorted mail in the same service

SpamFoo's Anti-Phishing catches impersonation of your staff and domains made to look like ones you trust, including domains that use letters from other alphabets. Email Classification sorts the mail people keep into Primary, Transactions, Updates and Promotions.

How switching works

Install SpamFoo Client on your mail server, or on another server you control, and connect your mail server to it. SmarterMail has SpamFoo built in, and other mail servers use the SpamFoo API. If your mail server is already busy, a hosted plan lets you run SpamFoo without adding load to it. Once SpamFoo is filtering, most people turn SpamAssassin off. You can also leave it running alongside SpamFoo while you get comfortable.

Source: The rules above are quoted from 20_phrases.cf in Apache SpamAssassin, which is licensed under the Apache License 2.0.