information technology central services at the university of michigan
Using SpamBox for E-Mail Spam Filtering

S4314 • July 2006

This document provides instructions for using ITCS's content filtering tool for spam, SpamBox. SpamBox keeps most spam messages out of your INBOX by filtering them into a separate folder for you, where you can do a quick check for any misidentified messages before deleting the spam.

NOTE: This document is also available in Adobe Acrobat PDF and Microsoft Word formats.

Table of Contents


What SpamBox Does

SpamBox checks your incoming messages as they come in to the ITCS e-mail servers. It uses Bayesian and other statistical algorithms to compare the content of the messages (broken down into text strings called "tokens") to the information in a "dictionary" that it maintains. It tags messages it suspects to be spam (by adding some text to the message header).

Diagram showing how SpamBox works. Incoming messages are tagged on the ITCS e-mail machines. Then a server-sed filter filters the messages into your INBOX or SpamBox folder as appropriate.

SpamBox is very accurate, but it will occasionally make a mistake when figuring out which messages are spam and which are innocent. For example, when spammers try a new technique, SpamBox may not recognize the messages as spam until it has been programmed to "learn" what they are. Also, if an innocent message has characteristics of mail that is typically spam, such as HTML code or embedded images, it may be misidentified as spam.

Turn SpamBox On Via the Web

Requirement
  • You must be using the ITCS e-mail service. SpamBox is installed on the ITCS e-mail servers, so it can only work with ITCS-provided mailboxes. (Note that SpamBox does not work with the ITCS Exchange Service.)

WARNING! Some U-M departments provide their own e-mail services. Before turning SpamBox on, please check with your department's information technology help desk to see if you are currently using one of these services. Many departmental e-mail services already provide spam filtering.

Using the SpamBox Setup Wizard
  1. Use your web browser to go to the Tools to Reduce Spam page on the Spam Busters web site.
  2. Click the SpamBox link.
  3. Log in with your uniqname and UMICH password.
  4. Select the e-mail program you use most, then click Continue.
  5. Depending on which e-mail program you selected, you may be asked whether your program is set up for IMAP or POP. This will allow us to tailor SpamBox for your e-mail setup.

    IMAP users will have a SpamBox folder created for them on the ITCS mail server, as well as a filter to work with it.

    POP users will need to create their own SpamBox folder and a filter or rule to work with it using their e-mail program. See Creating POP Mail Filters/Rules to Work with SpamBox (S4324) for details. For help figuring out whether you are using IMAP or POP, see How to Tell If You Are Using IMAP or POP for Your E-Mail (S4322).

    IF YOU USE MULTIPLE MAIL PROGRAMS: As long as all the mail programs you use are using IMAP, everything will work fine.

  6. You'll be notified that SpamBox has been turned on for your ITCS e-mail mailbox.

When you turn SpamBox on for your ITCS IMAP e-mail mailbox, three things happen:

  1. SpamBox mail tagging is turned on for your incoming mail.
  2. A server-side filter is created to filter the tagged messages.
  3. A SpamBox folder is created inside your mailbox as a repository for messages tagged as likely to be spam.

NOTE TO POP USERS: If, when you turn SpamBox on, you indicate that you use a POP e-mail program, only the first of these three things happens.

TIP FOR PINE USERS: If you would like to be able to check for messages in your SpamBox folder by pressing the Tab key, add this to the incoming-folders line in your .pinerc file:

incoming-folders={mail.umich.edu}SpamBox

Your New SpamBox Folder

Once SpamBox has been enabled for your ITCS IMAP e-mail account, you will notice a new folder/mailbox in your folder list called SpamBox. Any incoming messages identified as likely to be spam will be put there. You will need to regularly look in this folder to check for any non-spam messages mistakenly placed there and to delete the spam messages.
If You Accidentally Delete the SpamBox Folder
If you should inadvertently delete the SpamBox folder, you can create a new one yourself. Be sure to name it SpamBox, making the name all one word and matching the capitalization and lower case letters exactly. The server-side filter will not be able to put your suspected spam messages in the folder if the folder name is different in any way.
Tips for Making Your SpamBox Folder Appear Using Various E-Mail Programs
If you do not see your SpamBox folder after turning SpamBox on, you may need to tell your e-mail program how to find and display it. Here are some ways to do that:

  • Quit and reopen your e-mail program.
  • Look for a Refresh Mailbox List command and use it.
  • Look for a Synchronize Folders command and use it.
  • Look for a Subscribe command and use it.

Apple's Mail Application (IMAP)
  • You may need to expand the remote/global folder list. If you have an icon in your mailbox folder list that looks like a globe with an @ symbol, try expanding the list to see your SpamBox folder.
  • Sometimes rebuilding causes the folder to appear. From the Mailbox menu, select Rebuild.
  • Some Mail users have reported that if you are using an old version of Mail, you may need to delete your old Mail preferences, set up new ones, and restart your computer.

Entourage for Mac OS X (IMAP)
  1. In the main Mail window, in the Folders pane, select the folder icon for your IMAP account.
  2. From the View menu, select Receive Complete Folder List.

Eudora (IMAP) for Windows
Right-click the dominant folder and select Refresh Mailbox List.

Mozilla Thunderbird
  1. In the Folders list at the left side of your window, click the name of your ITCS e-mail account.
  2. In the Mozilla Thunderbird Mail pane that is now on the right side of your window, click Manage folder subscriptions (in the Advanced Features section).
  3. A dialog box will open with all your IMAP folders listed. Your new SpamBox folder will likely have a dot next to it in the Subscribe column. Click that dot to change it to a checkmark.
  4. Click OK. Your SpamBox folder will now appear in the Folders list.
Mulberry (IMAP)
If you use Mulberry on more than one computer and can see a SpamBox folder from one computer but not the other, follow these instructions. On the computer where the SpamBox folder does not appear:

  1. In the Servers window (the window with the list of folders), select the top item in the list of folders (it will probably be called either "IMAP" or "INBOX").
  2. From the Mailbox menu, select Display Hierarchy, then Refresh.

Netscape 7 Mail
  1. In the list on the left side of your Netscape Mail window, click the name of your mail account to select it.
  2. From the File menu, select Subscribe.
  3. In the Subscribe column, next to the SpamBox folder name, check the checkbox. (Macintosh users will see a dot instead of a checkbox. Click the dot to change it to a checkmark.)
  4. Click the Subscribe button.
  5. Click OK.

Outlook (IMAP)
You may need to subscribe to the SpamBox folder to see it.

  1. In the Folder List on the left side of your Outlook window, right-click your IMAP mailbox.
  2. In the folder list that pops up, left-click IMAP Folders.
  3. In the IMAP Folders box, click the Query button. A list of all your IMAP folders will be displayed.
  4. In the list of IMAP folders, click the SpamBox folder. (It will not have a yellow folder icon next to it.)
  5. Click the Subscribe button to the right of the SpamBox folder name. (This will cause the yellow folder icon to appear next to the folder name.)
  6. Click OK.

Outlook Express (IMAP)
You may need to subscribe to the SpamBox folder to see it.

  1. In the Folder List on the left side of your Outlook Express window, click your mail.umich.edu mailbox.
  2. Click the IMAP Folders button.
  3. In the Show/Hide IMAP Folders dialog box, click the Reset List button.
  4. In the list of folders, double-click the SpamBox folder name so that a folder icon appears to the left of it.
  5. Click OK.

Other Programs
Although ITCS only provides support for the Mulberry, Pine, and web-based mail.umich.edu programs, we are happy to include tips for other programs in this document. If you have a tip for getting the SpamBox folder to display using another mail program, please send it to itcs.doc.comments@umich.edu.

It Is Important to Check Your SpamBox Folder Regularly

Check your SpamBox folder regularly for these reasons:

  • To check for messages that might have been misidentified as spam.
  • To delete the spam messages and keep your mailbox size manageable. Messages in your SpamBox folder do count toward your mailbox size quota.

Keeping Mail from a Particular Address Out of Your SpamBox Folder

If you would like to be sure that mail from a particular address (perhaps that of your parents or your spouse) will never get mistakenly placed in your SpamBox folder, you can do this by adding that address to your Accept List. Then all mail from that address will be put in your INBOX regardless of whether SpamBox "thinks" the mail looks like spam or not. See this document for details:

Turning SpamBox Off

If you later decide that you do not want to use SpamBox, you can turn it off.

  1. Use your web browser to go to the Tools to Reduce Spam page on the Spam Busters web site.
  2. Click the SpamBox link.
  3. Log in with your uniqname and UMICH password.
  4. Click the Turn Off SpamBox button.

Reporting SpamBox Errors

You do not need to report the errors that SpamBox makes. If, however, you would like to help us continually improve its ability to identify spam, here are instructions for reporting errors.

IMPORTANT! To report errors, you must use the web-based web.mail.umich.edu. When you turn SpamBox on, spam-reporting links are added to web.mail.umich.edu for you.

To report spam in your INBOX
  1. Open your mail using web.mail.umich.edu (http://web.mail.umich.edu).
  2. Open the message, then click the This is Spam link. Note that this link is only available inside your SpamBox folder; it does not appear in your other folders.
  3. Screen shot showing the This Is Spam link.

  4. You will see confirmation that the report has been made.
To report innocent mail in your SpamBox Folder
  1. Open your mail using mail.umich.edu (http://mail.umich.edu).
  2. Open the message, then click the This is Not Spam link.
  3. Screen shot showing the This Is Not Spam link.

  4. You will see confirmation that the report has been made.

IMPORTANT! Web.mail.umich.edu can only recognize one folder for spam mail. If you change your web.mail.umich.edu preferences to select a folder other than SpamBox for your spam folder, please be aware that the This is Not Spam link will no longer be available inside your SpamBox folder. Instead, that link will appear inside whatever folder you designate as your spam folder.

Additional Resources

Visit ITCS's Information System to obtain ITCS computer documentation and other resources. A list of relevant documents follows:

We welcome your comments; please send e-mail.

ITCS's Online Help Desk provides a variety of computing help resources.

For further help with SpamBox, send e-mail or phone (734) 764-HELP.

Appendix A: Frequently Asked Questions

Why can't I see my SpamBox folder?
There are two possible reasons for this:

  1. The IMAP e-mail program you are using may need to be prompted to look for new folders. See Tips for Making Your SpamBox Folder Appear Using Various E-Mail Programs earlier in this document.
  2. If your e-mail program uses POP rather than IMAP and you are therefore downloading your mail to your computer, you will not see a SpamBox folder. This is because SpamBox cannot create a folder on your local computer. See Creating POP Mail Filters/Rules to Work with SpamBox (S4324) for details.

Can SpamBox be fixed to filter a specific address/keyword/domain? Why did this message get identified as spam and that similar message go into my INBOX?
SpamBox is not a keyword filter, so it does not decide whether a message is spam based on the sender's address or the presence of a particular word or phrase. Instead, SpamBox breaks each incoming message up into small character strings called "tokens" and then uses Bayesian and other statistical algorithms to compare the message tokens against tokens in its spam and not-spam dictionary. Based on this analysis, it calculates the probability that each token, as well as the chains of tokens, are spam, then determines the probability that the entire message is spam.

If you'd like to learn more about the Bayesian approach to spam filtering, these web pages are good resources: http://paulgraham.com/spam.html and http://paulgraham.com/better.html

When spammers try a new tactic, SpamBox may miss some of the new spam that is sent until information about it is added to its central spam information. That information is updated regularly.

The directory forwards my mail to my ITCS mailbox and to my Comcast (or other) address. Why is all the spam still going to my Comcast address?
The message is sent to Comcast before SpamBox sees it. Here's what happens: Mail addressed to uniqname@umich.edu comes in to the mail gateway machines, which get your forwarding address(es) from the directory. The directory has both your campus address and your Comcast address. So, the gateway forwards a copy of the message to both addresses.

One copy goes off to your Comcast address, and the other goes to the machine where your U-M mail resides -- one of the ITCS mail servers. SpamBox is installed on that machine. Therefore, it can only work on mail that goes to your ITCS mailbox.

Can I make Apple's Mail Application tell me when there are messages in my SpamBox folder?
Mail does not always "count and make bold" the SpamBox folder. That means that Mail will not alert you when there are new messages in that folder. You can click the folder name to force an update, or check the folder regularly.

I see my SpamBox folder in mail.umich.edu (or some other program), but not in Pine. Why not?
Some people have their Pine defaults set so they are looking at folders in their IFS space and not seeing the ones on the IMAP server. If this is the case for you, you will need to change your Pine settings to display all your folders. See the IFS Folders and Pine section of Using Pine E-Mail at U-M (T7037) for details.

Appendix B: The Software Behind SpamBox -- DSPAM, Ingo, and Sieve

The spam-identifying software behind SpamBox is DSPAM. DSPAM is open source software available to the University at no charge. ITCS staff members participate with others in the open source community to continually improve DSPAM.

Technical details about DSPAM are on the Nuclear Elephant web site.

DSPAM is set to tag mail as either spam or innocent. It works in conjunction with server-side filters to have the tagged mail sorted into your INBOX and SpamBox folder. The SpamBox setup wizard uses Ingo software (which is actually an application inside IMP, which is the software behind the web-based mail.umich.edu) as an interface to the Sieve mail filtering language to create a mail filter on the ITCS mail servers.

Technical information about IMP and Ingo is available in the Projects section of the Horde web site. The Horde Project is responsible for this open source software.


ITCS Home  |  University of Michigan