Brightmail Anti-Spam 5.1 By Larry J. Seltzer November 11, 2003

• Product: Brightmail Anti-Spam 5.1
• Direct Price: $1,499 per year (up to 49 users)
• Company Info: Brightmail Inc., 800-915-7726, www.brightmail.com

Brightmail's software is available directly from the company as a gateway-filtering product (which we tested). It can also be found embedded in e-mail appliances (such as those from IronPort) or being used by e-mail service providers (including AT&T and MSN Hotmail).

Brightmail's developers believe that a false-positive mistake—say, a note from a client treated as spam—can be very costly. True to that mission, Brightmail Anti-Spam (BAS) yielded not a single false positive on our tests. It did let 11.1 percent of the messages we deemed as spam through to our in-box, but that number was not out of line with the others here (the range was a low of 7 percent to a high of 37.9 percent, as shown on the chart below).

Microsoft Outlook users get a plug-in with This is Spam and This is NOT Spam buttons. They can use these buttons to move messages to appropriate folders or send them to Brightmail (and possibly to the local mail administrator). Brightmail takes This is NOT Spam messages very seriously and claims that each is evaluated by an employee at the company.

BAS runs on a separate server under Microsoft Windows Server, Red Hat Linux, or Solaris. We tested on Windows Server 2003, where administration is performed in the Brightmail Administration Console, an MMC snap-in. The console is not as powerful as that delivered by Postini Perimeter Manager, but it has many strengths.

Chief among them is support for different levels of filtering in various e-mail domains. Whitelists and blacklists can be set by domain or IP address. When used with Microsoft Exchange or Lotus Domino, Brightmail can deliver spam directly to a specific folder designated by the administrator, or it can simply mark up the subject line or headers and let the mail server or clients filter those messages.

The Conduit folder in the Console embodies the crown jewels of Brightmail's technology: a set of rules against which messages are judged. These rules are constantly worked on and updated by Brightmail, based on the company's diligence and feedback from customers. The changes are then automatically sent to customers' servers.

Header Rules are a series of pattern-matching tests looking, for example, for certain errors in mail headers typical of spam. Body Hash Rules are signatures of specific spams and, because of the more dynamic nature of spam today, are not as effective as they were in the past. BrightSig2 Rules is a more sophisticated signature test.

Heuristic Rules look for spam-like behaviors, such as random text at the end of a subject line. And if that's still not enough for you, BAS's custom rules builder is the most powerful among the products here. On top of all that, the Anti-Virus Rules module uses Symantec's Norton AntiVirus scanner interface to give an added layer of protection.

Brightmail Anti-Spam's false-positive score speaks for itself. If you want to make sure that important messages get through to your employees, BAS is the best answer we know of.