Spam Help

Spam Submissions

Please send an email from your registered address or alias to spam@armresearch.com. (NOTE: messages sent to support@ will be filtered out and not seen.)

The following are a prioritized list of how to forward spam to us:

• The best way we can get spam submitted to us is from a redirected spam trap. If you have one or more of these then please let us know and we'll set up a special collection point where you can redirect these messages.
• The second best thing you can do is to redirect the message to spam@.
• The next thing, and most common, is to simply forward (see below) the message to us at spam@ in as much the original form as possible. Some email clients forward messages more or less intact,... others tend to completely rewrite and/or "defang" messages that are forwarded. The former is preferred.
• The last option you have is to include it as a message attachment but only one message at a time please, and if possible please include the original headers. We don't always use these since most submissions to spam@ are suspect, but if we do dig deeper on a particular submission then the extra detail can be very useful.

Forwarding Spam:

To submit spam to us for filtering is to simply forward the unwanted message to spam@armresearch.com. This is fine for occasional submission by you and/or your staff. Please do not instruct your users to submit spam to this address directly. If you wish to do something like that then your best option would be to set up a UserTrap. If for some reason you are unable or unwilling to set up a pop3 UserTrap, then you can set up an alias on your system where your users can forward their spam and then have that alias redirect those messages to our spam@ address.

Technical Issues / Submission Format:

We are sometimes asked about the best format for submitting spam. Here are some guidelines:

• Submit each message individually. Do not batch submissions. Our system will very likely filter out the entire batch after catching only one piece of one message in the batch. As a result we will most likely never see the rest of the batch. Also, it is much more difficult to examine messages that have been re-encoded as batched attachments. One at a time please for best results.
• It is best for us to receive spam submissions exactly as they arrived at your server with their headers and mime structure in its original condition. Remember that SNF will see the messages in their raw SMTP format as they are arriving at your server. Any additional processing makes it more difficult for us to create rules that will match what SNF will see coming into your server.
• Do not simply submit message headers. Submit the entire message in SMTP format. Long ago it was common for messages to be filtered by headers (we never did it that way!). This was because most filtering was done by black-listing the IP address of the message source. While this is still done on many systems it is not the SNF way! Message Sniffer looks at the entire content, header, and structure of the message. Often the rules that matter most are the ones that take advantage of how the message was put together. SNF rules most frequently match content or structure -- these things are lost if you only submit message headers. Please submit the entire message as it was received.

When in doubt it is usually ok to simply foward spam to our spam@armresearch.com address.