Most shared hosting companies nowadays have some version of Cpanel running on their server, being one of the most popular control panels available. This control panel software is very versatile with how it can be configured. Some hosts will set it up just as it is out of the box and others will install applications like SpamAssassin to help filter spam. Cpanel has also improved its spam filtration since it was created. In this article we will talk about some specific things Cpanel users can do to help reduce spam and some general rules for reducing your spam.
How does SPAM originate?
The Internet is still much like the Wild Wild West as there is no single governing body that can effectively regulate the worldwide use of the Internet and especially email. There are ways that spammers find to circumvent seemingly solid legal practices. Some jurisdictions have enacted laws to make these practices illegal. Unfortunately there are still many countries which have no such laws and/or do not even recognize the spam problem. This means that spammers outsource their practices to servers within these countries where they feel they have some protection from laws of other nations.
In addition to these spammers who use servers in other countries, spammers have joined up with the underground hacking/cracking/programming cultures. Tapping into these previously untapped resources they are able to join forces with people who can write even more sophisticated scripts, viruses, and malware. A practice that has become common is to create malware that unlike a virus is often very quiet about its business. By exploiting known holes in operating systems and applications running on computers and individuals who may not know better these pieces of software create a worldwide zombie network which carries out lascivious practices day and night with little to no direction from the spammer once it has been setup. Rarely do people actually notice these pieces of software unless their ISP contacts them or if the malware has left a backdoor open for other pieces of malware and viruses to be installed which then start causing problems.
Phishing has also become a large underground business collecting data on people all over the world from email addresses to personal information. Once completed profiles have been established they are sold in underground black markets for large sums of money.
Some researchers believe that more than 85% the email being sent at any given time worldwide is considered SPAM. Having maintained numerous mail servers with advanced spam detection and filtration software we have seen that 90% of all mail received by a server in a given day has been spam.
However there are things you can do to get some relief and help reduce spam in general.
1) Keep your virus scanner updated - ALWAYS. Viruses multiply at exponential rates and spread extremely quick. Sometimes viruses exist on a computer for months before becoming active or causing a problem. So making sure your virus protection is up to date is extremely important.
2) Don't list email addresses anywhere on your website. Use a contact form instead. Doing this will allow you to receive contact from visitors on your site without exposing your email address to the general public.
3) Don't list your email address in forums, social networking sites, or any other community oriented place. If you want or need to do this, setup a free email account somewhere like at HostBigger.com or Yahoo.com to use just for these sites. If you still don't want to do that and must list your address for all to see use the expanded email notation which basically writes out the whole email address. For instance user@domain.com would be "user at domain dot com". This helps keep the programs that search the net from harvesting your email address.
4) Don't unsubscribe from something you never subscribed to. If you ever get an email that is spam and you see the option to unsubscribe - don't. This is a verification to the spammer that there is a live person on the other side of that email. You are almost guaranteed to get more spam. It may diminish for a little while but will start coming back.
5) Use Validation on your website contact forms. Captcha is a good start to prevent spam from coming through your website contact forms. However there are mechanisms out there that can now read Captcha letters. A good solution is ReCaptcha.
6) If you still receive a large amount of spam you should make sure your webhost has an email filtration system in place for your email. Good filtration systems allow you to set the threshold of spam so that good email is not regularly affected (although a few false positives will occur). Some systems even allow you to set 2 or more thresholds - one for low scoring spam and the others for high scoring spam. This allows individuals who are concerned with losing legitimate email the ability to review any message tagged as a low level spam message while deleting blatant spam messages.
7) Check with your webhost to make sure your domain has a SPF DNS record setup.
8) Make sure that any web based application you have installed on your site is kept up to date. Spam that is generated from a hole in your coding is still your responsibility. In addition, many times spam from your domain will result in more spam being sent to your domain.
9) Don't use your hosting providers catchall email account. This account is usually the default email address on your hosting account and will catch any unrouted email which invariably means spam. If you only use your catchall - STOP! Setup your own email accounts on your domain and use those.
10) Don't use easy to assume email addresses unless you have to. For instance info@domain.com, support@domain.com, etc. Be more creative while staying user friendly when setting up your email addresses.
For Cpanel users if you want to reduce SPAM here are some additional tips.
1) Use SpamAssassin - SpamAssassin is a spam filtration product that is a open source software that can be installed with Cpanel. It is the foundation of many spam filtration services and products. If you are not sure whether SpamAssassin is installed on your hosts server, ask them. Once installed, in Cpanel you can specify how SpamAssassin identifies spam messages. You can configure SpamAssassin/Cpanel to append a word or phrase to all spam messages so that you can easily sort. We recommend using a series of Letters and Symbols that are not separated by space. You can then setup a filtration rule to delete any messages with this particular word or phrase in the subject. Keep in mind however, SpamAssassin can and does bog down the server if the level of spam the mailserver receives is very high.
2) Use RBL Checking - Cpanel has recently added the ability for hosts to configure their mail servers to check for the presence of an IP address in one of 2 common blacklists. This check happens when the initial mail connection happens. If the connecting IP is found in the blacklists they are blocked from further sending messages. This really seems to help reduce spam that is obviously sent maliciously since the IP has already been reported for spam activity.
3) Ensure MailHeaders are turned on - This particular tip is more towards the hosts, rather than the end user. This appends a users server username to the headers of an email as well as where the email was sent from (in the event of an email sent from an automated form) . This way if a particular message sent from the server is reported as SPAM a Cpanel Server Administrator can look in the Cpanel servers logs and determine if the user is sending spam or is running an application that is exploitable. Sending spam is often a cause for a server to receive even more spam. So if a spam issue arises it is best to resolve it ASAP.
4) Set SpamAssassin to AutoLearn - SpamAssassin has the ability to autolearn messages that are spam. This autolearning process requires user input however so it can build a database of what is considered spam and what is not. Therefore this function would have to be configured by your Cpanel Administrator.
We hope you find these tips useful and helps you reclaim your personal and professional productivity.
- Jason A. Taylor; is CTO of CWI Hosting, and has worked with thousands of email accounts and hundreds of mail servers. Having tested and deployed many anti-spam solutions, including on cpanel servers, you can find spam email solutions here.
