SurfControl E-mail Filter By Richard V. Dragan February 25, 2003

• Product: SurfControl E-mail Filter
• Direct Price: 500 users, $9,000 direct
• Company Info: SurfControl plc, www.surfcontrol.com

Editor Rating:

SurfControl E-mail Filter offers the most administrative tools of the solutions we reviewed, but in our testing it proved less accurate than the CipherTrust IronMail 210. The product also requires the most effort to use effectively, and it isn't cheap.

We installed SurfControl's software on a test server running Windows 2000 Server and ran its suite of tools to set up and tune our e-mail system. A Web-based interface with a subset of the installed software's capabilities is also available. The SurfMail E-mail Rules Administrator lets you respond to particular kinds of e-mail activity, including spam, adult content, and jokes. A separate $8-per-user antivirus module is also available.

Control over responses for individual users is precise. On a tabbed screen, you can select specific users and which rules to apply to the incoming mail, then how to respond to spam and other mail categories. You can have the system delete, delay, or quarantine the suspected spam. This part of the interface is innovative, because conditions for rules are highlighted as you move your mouse over the options. On the back end, SurfControl E-mail Filter uses hashes, blacklists and whitelists, and lexical analysis.

With SurfControl's software, you manage different aspects of e-mail through several tools rather than in a unified console. So we found ourselves jumping between windows a lot. The Dictionary Manager let us view and tweak lists of words to block different categories of e-mail. As with the IronMail, individual words are tagged with point values, used to sort e-mail into categories such as porn, gambling, or drugs. We had to turn down the point value for the Las Vegas category, as this caused false positives among legitimate e-mail about the Comdex trade show.

Administrators will need to do a good deal of tuning with this solution—typically six weeks, according to SurfControl. Without such extensive tweaking, the tool's accuracy suffered: It missed 19.57 percent of the spam it encountered. But in its favor, the software produced very few false positives.

To help you monitor e-mail traffic, a separate utility, the SurfControl E-mail Message Administrator, shows flagged messages and lets you analyze each message's flagged words by point value against a dictionary. Administrators can use this to see what's offensive in a particular message quickly and decide what to do with it.

The Windows-based Message Administrator offers fast access to messages. It can scroll through e-mail without a Web query, which the hosted solutions require. The Web version of SurfControl's console offers a subset of the Windows version's basic features, including reports showing e-mail activity such as percentage of received spam by user or by IP address and top 20 spam senders. Administrators can use these reports to tweak their dictionaries, blacklists, and whitelists.

Constant administrative vigilance is a fact of life with SurfControl E-mail Filter if you hope to get better results than we did. It offers the most precise options for fighting spam among the products we reviewed, but it will also place the most demands on administrators.