To help better understand how spam is sent and how SpamStopsHere blocks it, let's learn the basics of how email is sent on the Internet.

Server names, IP addresses and other identifiers used here are for illustration purposes only; they may be fictitious and are not to be relied upon as accurate. See your provider's documentation for actual server names and IP addresses.

Assume your work email address is john@example.com and your company has its own mail server. When someone sends you an email, their server queries the public Domain Name Service (DNS) system to find the address, or "MX record", of your mail server. The answer to the query might consist of a single MX record, such as:

 example.com   MX   priority=10   MAIL1.EXAMPLE.COM

which basically tells outbound mail servers to send your email to the mail server MAIL1.EXAMPLE.COM.

Such names are easy for us humans to remember and type, but Internet traffic can only be routed by numeric IP addresses. So, the sender's server then looks up your mail server's "A" record, which tells it the IP address for that name. It's like looking up a person's street address to put on an envelope. The sending server then connects to that IP address and sends the message.

Your mail server records (in the header of your message) the IP address of the sending mail server. It also records the sender's supposed* email address. Your mail server then delivers the message locally to your john@example.com inbox and holds it until you log in and check your email.

*Spammers often use a fake reply email address and even a fake name for their mail server (that's called "spoofing"). However, they cannot fake the IP address of their mail server.

More about DNS "MX" records

If your domain's web and email is hosted by a third party company, then more than likely that hosting company has set up your MX records for you. If your domain's web or email is hosted on your own servers, then the person (probably you) in charge of them or the IT department, set up the MX records.

While most domains have just one "MX" record, your domain can have multiple MX records. After you sign up for our service and receive our confirmation, you activate the service by adding three more MX records to your domain. The MX records might then be:

example.com   MX   priority=5    example-com.relay1a.spamh.com.
example.com   MX   priority=6    example-com.relay1b.spamh.com.
example.com   MX   priority=10   mail1.<hosting company>.com
example.com   MX   priority=20   example-com.relay1c.spamh.com.

When a mail server sends email to your domain, it first attempts to send it according to the MX record with the highest (lowest numerically) priority. If the two servers fail to establish a connection, the sending mail server tries the next highest priority MX record, until it goes through all of the MX records.

In the example above, "example-com.relay1a.spamh.com" has the highest priority and will therefore receive all mail (unless there is a connection failure). As described later, this is our mail "relay" which filters your email for spam. After we filter your email, it is then relayed back to your actual mail server, "mail1.<hosting company>.com" in this example, set in the Control Panel. Because your actual mail server is a private configuration setting, it doesn't even need to be in the MX records, as you will read later.

A nice feature of MX records is built-in "auto-failover". If the highest priority mail server goes offline, mail is automatically sent to the next highest priority mail server.

Therefore, if the primary anti-spam relay for your domain should go off-line due to a system failure, maintenance, or any other reason, the backups automatically take over. In the unlikely event the primary two relays for your domain went off-line, email would be sent directly to your "real" mail server. So you wouldn't lose any email, it just wouldn't be filtered for spam.

When our service is activated, you will have to change, or authorize the change of your MX records. We cannot do that for you; only you and possibly your hosting company have (legal) access to your MX records.

When changing MX records, keep in mind that the changes do not take place instantly because many DNS servers will have cached the old entry. Therefore, the changes must "propagate" throughout the Internet's many DNS caches. The suggested time to cache a record "lookup" is set by the "TTL" (Time-To-Live) value for your MX records but some sender's' DNS caches will take a bit longer to update. A typical TTL value is 43200 seconds (12 hours) or 86400 seconds (24 hours). After the MX record changes are complete, some email will start being filtered immediately. Even more will be filtered after the TTL is past but the majority might not be filtered for up to 72 hours. This is because some DNS caching servers don't honor TTL values, but cache records for up to 72 hours.

If you don't know how to change your MX records, that is no problem. This probably just means that someone else takes care of that for your domain. We will email you the necessary information and you can simply forward the request to them (probably your email hosting company or IT department).

More about the anti-spam relays

The page SpamStopsHere Technical Details describes how our service blocks spam based on URLs, content, countries and black-lists. This is an explanation of how the relays work.

When your service is activated, you will be assigned three "relays" (servers) which must be added to your MX records. One is the "primary" relay and the others are the "backup" relays.

Since spam filtering is certainly desirable, but not mission critical, you might think that having a backup relay is overkill. There are several reasons why every customer gets backup relays:

  • It allows us to perform maintenance work on one relay without disrupting your service.
  • As described later, for maximum spam blocking, you can remove your "real" mail server from the MX records. In that case, a backup relay is needed for maximum reliability.
  • For your peace of mind and ours. We recognize that email is now critical to any business.
  • To allow us to do some load balancing.

Each relay is actually a cluster of dedicated servers that we rent from large data centers with redundant fiberoptic internet connections, 24/7 monitoring, UPS and generator backup and physical security. For maximum reliability, the primary and backup relays assigned to each customer will reside in different data centers, owned by different companies, in different regions of the United States.

When using our service, the weakest link in your email reliability is probably the reliability of the DNS servers that hold your MX records. Domains are supposed to have two DNS servers, but unfortunately both servers are often in the same room on the same Internet connection.

The SpamStopsHere website is database driven and resides on another dedicated server, separate from the relays. This server handles all account information, including any changes you make via the "Members" control panel. Every few minutes, this server automatically updates the databases on the relay(s) with any changes that you make in your SpamStopsHere control panel.

Options to stop even more spam (Optimal MX Records)

Adding our anti-spam relays to your MX records will typically stop 95% of all spam. By implementing the options described here, you can typically stop 98% - 99% of all spam.

Some "sneaky" spam is not sent to the highest priority MX records, but rather to the lowest priority MX records. This is an attempt to bypass spam filters, such as ours, since the "real" mail server is typically listed in the lowest priority MX record. (This probably can't happen with open relays, but only with spammers that have modified the mail server software just for this purpose.) This is often the most offensive, vulgar spam of all.

One method of reducing this sneaky spam is to "sandwich" your real mail server between our relays as in the following example MX records:

 example.com   MX   priority=5    example-com.relay1a.spamh.com.
 example.com   MX   priority=6    example-com.relay1b.spamh.com.
 example.com   MX   priority=10   mail1.<hosting company>.com.
 example.com   MX   priority=20   example-com.relay1c.spamh.com.

Notice that both the lowest and highest priority MX records point to our service. This is the intial configuration that we recommend when signing up.

While this "sandwiching" helps, some sneaky spam will still bypass our service and hit the real mail server directly.

The solution to stopping this spam, is to remove your "real" mail server from the MX records, leaving only our relays, as in the following example MX records:

 example.com   MX   priority=5    example-com.relay1a.spamh.com.
 example.com   MX   priority=6    example-com.relay1b.spamh.com.
 example.com   MX   priority=20   example-com.relay1c.spamh.com.

Note: If your domain uses an ISP's mail server, the ISP may not allow you to remove their mail server from your MX records. Making these changes might interfere with the successful handling of your email by your ISP's mail server. You should check with them before attempting it.

Since your email then depends entirely on our servers, you will appreciate that we provide all customers with a redundant configuration on our end. While our service is designed to provide the highest reliability, we still ask that you follow these implementation guidelines:

Wait at least a few days after activating our service before removing your mail server from the MX records. Confirm that our service is working by examining the headers of typical email messages. You should see that your mail server received the message from our relay. While the change shouldn't cause even a single email to be lost, plan on making the MX change during a quiet period. Then make the change, wait for amount of time set by the TTL value (typically 12 hours), and test by sending email from another domain, e.g. Yahoo or Hotmail. If it doesn't seem to work, please call us for technical support and/or restore the original MX records. It is not necessary to contact us or even to make any changes to your SpamStopsHere control panel when removing your mail server from the MX records

To completely stop aggressive spammers from directly hitting the mail server, some of our customers have configured their firewall or email server to only accept mail (traffic to your email server's TCP port 25) from our servers. If you wish to do this, please use the Firewall Feature in the SpamStopsHere Control Panel, which when enabled will cause all of your filtered email to come from a specific list of IP addresses.


Other Resources