Think Twice: Know how Zoho Mail protects you from spam

In the first two parts of the Think Twice series we discussed email spam, those uninvited guests who wreak havoc at your email party, as well as types of email spam and tips to prevent it. Now that you know all about the trouble spam brings, you might be curious to know what reputable email service providers (ESPs) are doing to help protect users from spam of all types. 

One of the challenges ESP's face is correctly identifying whether an email is spam or legitimate. Zoho Mail does this by studying community data—how and which users mark an email as spam or not spam. With the help of community data and pre-defined conditions, our servers can automatically identify half a million spam emails per hour on average with an admirable success rate. The use of community data in spam processing extends further.

Say a user is sending an email from a third-party email server to a Zoho Mail user. For that email to get delivered to the recipient's inbox, the sender's IP should hold a positive reputation. The reputation score of an IP is dependent on the number of spam and non-spam emails generated from that IP. When a source with low reputation places an email transfer request to the Zoho Mail server, we will either reject the email or deliver it to the recipient mailbox's spam folder, depending on the user settings.

Please note that all the below mentioned filtering is applicable only for illegitimate emails with malicious spam fingerprints or emails you (the user) marked as spam. Zoho Mail does not filter your legitimate emails automatically.

Let spam stand in the bay:

If the nuances of classifying the right emails as spam is a challenge, determining the right approach for bulk emails is a bigger challenge. Though our filters can recognize and sift out emails with spam fingerprints—attachments masked with malware, phishing links, malicious executable macros, non-RFC compliant emails, unsolicited bulk emails, and more—the approach we need to take for each of them differs. While we filter out phishing emails more vigorously, reducing the false positives, we take a more user-specific approach concerning bulk emails, given that a bulk email can be spam to one user and of interest to another.

With the help of user-centric and organization-wide spam control settings, administrators can customize and choose what kind of emails they want Zoho Mail to deliver to their inbox. Starting from choosing which parts of an email you want us to analyze using our filters, administrators can choose to show sender-based alerts, process spam based on specific languages, and quarantine or reject emails based on authentication framework (SPF, DKIM, DMARC, and DNSBL) verification. The administrator can also add specific emails, domains, and IP addresses to their lists like Allowed list, or Blocked list to receive or not receive emails from certain senders. Apart from the administrator maintaining an organization-wide list, each user can customize their own anti-spam lists to block or allow users of their choice.

Combat phishing with added accuracy:

In our previous post, we discussed the technique spammers use to phish for personal data: copying the user interface and experience of a legitimate organization, including the domain address. For example, say you maintain your finances at a bank named Woods, and "woods.com" is their domain address. Now a spammer might phish using a domain—"vvoods.com" or "w00ds.com"—that looks like the legitimate address by changing a few letters to deceive recipients.

While our spam filters are capable of spotting such emails, you can also take additional spoof control measures for the domains that are significant to your organization by verifying all cousin domains of that respective domain. And it doesn't stop there. You can protect your organization members from spoofed emails and prevent this fraud from happening with the help of Zoho Mail's Display Name Spoofing feature.

Spam processing is not without its flaws because as ESPs improve their filtering mechanisms and block spam emails with higher accuracy, spammers also become more advanced in their masking techniques by using reputed services. Some spammers have started following RFC rules, SPF and DKIM authentication protocols, among others to escape spam processing. This new, evolved spam can sometimes slip through the filters and end up the recipient's inbox.

This is why we're constantly updating the Zoho Mail server to learn new fingerprints even with a small sample size. And don't worry: even if one or two spam emails escape our wall of filters, our post-delivery spam check can identify and mark those emails as spam automatically.

Given all the challenges in identifying and processing spam, we at Zoho Mail place our users' safety and security before every other priority. We have already added a ton of new spam control features to our all-new admin console. As we move forward, we'll continue refining our techniques even further to improve your experience.

We hope the Think Twice blog series has helped you learn more about email spam and ways to prevent it! Give Zoho Mail's anti-spam features a try and let us know what you think.