The Spam Foo.. seems to have lost it way...

9/9/2026 at 4:37 PM

Employee Post

SpamFoo updates their engines occasionally. Ideally, the update takes into account new findings. If spam isn't getting scored by SpamFoo, when it once was, I'd recommend starting a ticket with support, and, if possible, sending over some of these emails in their raw EML format. We can forward them over to SpamFoo and they can dig into them.

Derek Curtis

CCO

SmarterTools Inc.

www.smartertools.com

D

Daniel Replied

9/10/2026 at 12:33 PM

We have been receiving the same types of emails for several days, for example:

“Hello, I want to change my bank account for the salary”

from nxjwhsbnduwedb@gmail.com

or

“I have a discrete task for you. Give me our WhatsApp number and wait for further instructions.”

from dnd3bdh@gmail.com

They keep getting through despite being reported.

Does reporting these emails as spam via the Spamfoo web interface have the same effect as reporting them through the mail client?

Rod Strumbel Replied

9/14/2026 at 12:26 PM

Could this be caused by bad actors authorizing their own emails and submitting them to Spam Foo as valid? Not sure how SF isolates approvals to be sure they SHOULD REALLY be allowed or not.

Tim Uzzanti Replied

9/14/2026 at 2:22 PM

Employee Post

Rod,

We are seeing the opposite internally and while working with customers. If you have concerns, I would open a ticket.

SpamFoo has become incredibly stable, and results have been steady. SmarterTools and SpamFoo mutually agreed to extend the BETA to December 1st, due to the fact that they are introducing new phishing functionality and will have a standalone gateway version that can be run on a separate server, both of which will require additional integrations with SmarterMail.

After December 1st, SpamFoo will replace the current SPAM solutions we offer. Cyren and Message Sniffer will continue to run based on your maintenance and support agreement. As I mentioned before, Cyren and Message Sniffer were acquired a while back, and the overall products and services have degraded significantly. Cyren has been one of our leading complaints in support based on the number of outages they have had.

Tim Uzzanti

CEO

SmarterTools Inc.

www.smartertools.com

t

terry fairbrother Replied

9/15/2026 at 3:29 PM

I personally don't hold spamfoo in any high regard. The vast majority of blocked emails come in marked as spam as they have hit a multitude of routing rules. What gets past those rules should have still been through RspamD and SF, yet my client's users still get spam from wells fargo, web site designers etc.

Whilst I acknowledge that SF has made an impact on your company, the one I look after are fully in marketing and as such SF simply cannot decern those emails which are genuine and those that are spam. So I heavily rely on custom weights with minus figures for both trusted domains / email addresses / phrases / keywords to ensure those emails do get through to the users.

I also seem to spend too much time whitelisting genuine domains / emails and sending false positive reports off to them.

Whilst in beta, I keep my fingers crossed it gets better, but as a paid product, I doubt it will be something I will buy.

D

Douglas Foster Replied

9/16/2026 at 6:19 AM

The default install of Spamfoo is useful as a proof of concept, but a different approach is needed for the best solution.

You need a way to control which messages go to Spamfoo and which do not, and you need multiple level filtering

Threat control needs to occur at the server level. Policy enforcement needs to be handled at the domain level, Domain filtering alcts as a backup for failures in server-level threat filtering User filtering handles user preferences and acts as a stopgap defense for failure in the upper levels.

Spamfoo can do multi-level filtering, but not as currently packaged.

I call Spamfoo from Declude on my incoming gateway to do system level filtering. I only have one policy organization, so I do not need separate filtering at the domain level, and I don't have the computer resources to run it on my main server for user level filtering I rely on manual review of the Training folder for the user level feedback.

I dont call Spamfoo for messages where the disposition is already chosen. Asking Spamfoo for advice on those messages is a waste of effort and can only produce errors.

I have concluded that Ionly need it for the 100 messages per day from unknown senders with unknown reputation. For these messages, my choice is to trust Spamfoo or accept a default (blind) disposition. With that choice, it cannot let me down. I manually review quarantine for messages that should be delivered and delivered messages for allowed threats. Results of both reviews are used to send Spamfoo feedback. This was not a lot of new code because I was building on tools already built.

One benefit of the Spamfoo Beta is that people are thinking about what they really need. Not long ago, I wrote about the need for message review tools, with a complaint that my Barracuda Email Security Gateway seemed to be the only available solution. My post was met with silence, the forum equivalent of blank stares. Now, Spamfoo has caused people to start asking for a message review capability. You cannot win the battle with spammers if you cannot see actual messages

Tim Uzzanti Replied

9/16/2026 at 6:28 AM

Employee Post

Terry,

The nice thing about our integration and relationship with SpamFoo is that we can investigate specific instances where you believe something should or shouldn’t have been caught. If you’re interested in improving your results and moving away from legacy, rules-based approaches, please contact support and we will look into it with you.

Yesterday, I thought SpamFoo had given me a false positive on an AT&T marketing email. It turned out that SpamFoo had actually classified it correctly as a legitimate marketing email from a genuine company, while two RBLs and Rspamd had flagged it as spam. In this case, SpamFoo got it right, while the more traditional spam checks incorrectly flagged the message.

We recently had a meeting with SpamFoo, and they showed how they are doing reputation-based work. Their backend infrastructure evaluates websites that emails come from. They showed us dozens of websites that had the same exact content. Basically, they are parked domains that were supposed to look legitimate, but SpamFoo on the backend knows they are bullshit marketing websites and emails. They also look at the frequency in which websites are updated and more. For example, I asked them show me the reputation for SmarterTools and their backend result gave us a very high reputation because they saw how active our website is and the frequency of our product releases. It’s pretty incredible stuff, and relying on rules-based approaches compared to the intelligence going into SpamFoo is like comparing a Ford Model T to a Tesla.

Tim Uzzanti

CEO

SmarterTools Inc.

www.smartertools.com

D

Douglas Foster Replied

9/16/2026 at 10:57 AM

Although our approaches are different, I mostly agree with Tim's conclusions. There are two types of ftering: decisions based on knowledge and decisions based on heuristics. I have spent years collecting knowledge, and I quarantine most traffic where knowledge is lacking.

If you are dependent only on heuristics, A.I. is your best hope. If you have knowledge outside of A.I, you need to make them work together. Knowledge based rules are alive and well. Weighting rules are doomed.

John Quest Replied

9/16/2026 at 12:05 PM

I personally don't hold spamfoo in any high regard. The vast majority of blocked emails come in marked as spam as they have hit a multitude of routing rules. What gets past those rules should have still been through RspamD and SF, yet my client's users still get spam from wells fargo, web site designers etc.

Whilst I acknowledge that SF has made an impact on your company, the one I look after are fully in marketing and as such SF simply cannot decern those emails which are genuine and those that are spam. So I heavily rely on custom weights with minus figures for both trusted domains / email addresses / phrases / keywords to ensure those emails do get through to the users.

I also seem to spend too much time whitelisting genuine domains / emails and sending false positive reports off to them.

Overall, it sounds like you are in circumstances that no out-of-the-box solution will meet, meaning that you are expecting fairly common tools, such as the type that SpamFoo is, to work without a lot of "hand-holding".

I am also in that circumstance. I deal with what is probably within the top 5 of hardest fields for email filtering, the electronic components industry.

That being said, what circumstances you are in, it will continue to be very hands on for the foreseeable future. BUT, SpamFoo will indeed help.

Right now, my gateway email server uses Mails Best Friend DR (and Declude before that) as the primary "filtering" mechanism for our internal Exchange server. That will be changing in the near future, as I will be replacing our Exchange server due to MS Licensing absurdity. Most likely, it will be replaced with SmarterMail. When that occurs, I will be relying upon SpamFoo on the internal email server for user interaction, which from everything I am seeing and reading so for, will go a long way to releasing some of the pressure I face in constant tweaking and adjusting on our gateway server.

9 Replies

Reply to Thread