One of our primary goals with the Tucows Email Service is to be competitive with the best email services, and to be the best wholesale offering available for service providers.

Just like we do with all of our services, it comes to you as a “white label” service, with no Tucows branding anywhere. This past month we’ve been working on making the webmail interface much more extensible so you can brand it and make it even more like your own.

Here are some highlights of what we’re prepping for release:

• Single sign-on - do your users log into a portal? Do you want them to automatically access the email service without logging in twice? You can do that now with the single sign on feature inside the Tucows Email Service. By passing a token, you can authenticate as that user, without having to know their password. That means seamless logins from your portal and an improved user experience for your customers.
• We’re making the branding tool more flexible - if you put in a logo bigger than our “webmail” logo, it will automatically expand to the size of your logo. The front login page will pick up the logo from webmail, along with your background colour. You can also add your own support links, and customize the window title bar.
• Support for ads - some of our resellers like to have ads in their webmail, or they want to totally overhaul the header and footer of the webmail. In order to meet everyone’s needs, we’re making it very flexible. The header and footer will support images, and iframes hosted on another server (including target urls). We’re also adding the ability to have an ad in the bottom left-hand corner of webmail.

There are a number of other changes that are outlined in the release notes, including usability enhancements, and more. Updated documentation is available as well.

The email team is excited to get this release out. The UI changes to webmail and single sign-on is already in our Test Environment, and the branding enhancements will be promoted to both Test and to Live on March 4th. Existing brands won’t be affected by the update.

Stay tuned - there’s more to come including more branding, more flexibility for service providers and more features for end users!

If you haven’t checked out our webmail yet, try it out! We can provision you a demo account — all you need to do is fill out a quick form here and we’ll set you up.

Today, spam filtering is a must, not an option. By some estimates, as much as 90% of mail sent is spam. The filtering that’s included in the Tucows Email Service provides effective protection for users against spam and viruses.

Starting today resellers can provision what we call “filter only” accounts inside the Tucows Email Service. Cutting to the chase, the net result is that email is sent through our filtering system, spam is redirected to a quarantine, and only the legitimate mail is then directed on to our customer’s email server.

Last fall at ISPCON in San Jose, CA, I had the opportunity to give a presentation about our experiences running Tucows Email Service. I called it “Email Nightmares: Tales from the Edge” and in that talk I showed some of the pain points that email providers run into when managing messaging services. One of the most challenging aspects I called out was managing spam.

That’s all well and good, but some email providers aren’t ready, or don’t want to move to a fully-hosted email service right now. So we came up with an alternative that allows us to provide that same level of spam and virus protection, while allowing providers to continue to use their own email infrastructure.

The benefits are threefold:

1. You’ll sleep better at night: you can focus on running your email servers, without having to worry about things like spam filters, or blacklists.
2. Your servers will thank you: nine out of ten messages is spam, and we’re taking care of that before you have to. As a result, your server loads drop significantly.
3. We’ve got your back: Tucows has a dedicated Abuse Team that is actively engaged in the battle against spam. We have experience managing abuse and we’ve forged strong relationships in the industry through organizations like the Messaging Anti-Abuse Working Group (MAAWG).

Our Tucows Email Service is built for ISPs and hosting companies. The goal with this filtering only option was to provide effective filtering for our customers that ‘just works’. Resellers have the option to provide a web-based spam quarantine where users can review email flagged as spam, and manage safe- and blocked sender lists.

Our Services website has more information including a screencast demonstrating the web-based spam quarantine.

The team’s efforts to enhance and improve the Tucows Email Service continue to accelerate as more and more customers make the move from our older platforms onto the new service. As that happens, we’re learning a lot about how Tucows Email Service handles the load in the real world (really well, as expected) and we’re also taking in feedback and comments from users, through resellers like you (thanks!).

As a result, we’re continually tuning hardware and software for even better performance, and the technical delivery team continues to work to make things like the webmail interface better and easier to use.

Tomorrow we’re rolling out what we call the “Email Winter Release” – a bunch of enhancements and upgrades that make the service even better. A full list of those changes was sent out to customers on Tucows Email Service last week. If you want a sneak peek at how things are progressing, the upgrade has already been rolled into our Test environment. We’ve also released updated Tucows Email Service documentation that includes the latest changes and all the details you’ll need. A detailed summary of the changes can also be viewed in the release notes.

The enhancements encompass everything from minor user interface improvements inside webmail, to the creation of a new user account level within the MAC. Here’s a brief list of what’s changing Tuesday broken down into three main categories:

Reseller Tools:

• Domain Aliases at the Company level are now available
• Company Administrators are now able to suspend accounts (and shortly will be able to do so through the APP)
• Mail Administrator account level has been created.

Webmail Enhancements:

• Users are now able to sort on the Read/Unread column.
• POP mail accounts (if added by the user) are checked automatically during webmail check.
• Contacts can now be dragged into and out of groups.
• Users can choose between plain text and HTML email composition.
• The add contact group button in the contact area of the sidebar has been replaced by a pair of more intuitive icons.

WAP/Mobile Email Client:

• We now offer a WAP client for email access via mobile phone.

One of the neatest additions that comes along with this release is the WAP version of webmail. A recent survey by Webcredible, a UK-based web usability and accessibility consultancy, showed that 33% of mobile phone users said email was their most requested feature.

Our WAP-enabled webmail works on over 5,000 different phones (including the iPhone, although it has an IMAP email app that works great with Tucows Email). It lets user see their inbox and messages, send and receive mail, and even view contacts. All the information on how to access the WAP browser including how to set a CNAME to enable a custom URL (like wap.yourdomain.com) is in the email documentation.

The WAP browser is a standard feature of Tucows Email Service – just like IMAP, POP and our AJAX webmail application. It’s available today in the Test environment, and will be live for all users tomorrow.

Back in December we told you that the replacement for our Email Defense service was in QA, and that we were planning to go live with the new service in January. True to our word, I’m happy to report that the newly minted offering we’re calling “Tucows Email Filtering” will be live the week of January 29th.

We have a lot to share with you in the coming weeks, and Email Filtering is just one part. I’ll follow up this post soon with a full explanation of how it works, including the thinking behind some of the changes that we’ve made. You’ll quickly understand why we’re calling this “new” once you see it in action.

In February we made a decision to nuke the portal for our Email Defense Service and move to filtering only for the time being. Back then, we promised to build a new and improved service to replace it. We’re pretty close to being ready, (it’s in QA now). It’s expected that we’ll go live with it in the first couple of weeks of January, after the holiday and our December code-freeze.

We took a look at Email Defense as it functioned back in February and decided to re-focus on simplicity. Making our services easier to use and administer is a mantra around here these days. The original “spam portal” had every bell and whistle imaginable, but just like lots of other web services and software packages, it was over-engineered. In reality, very few of those features were actually being used. Here’s what we found:

• End Users only used the quarantine, and the blocked/sender lists
• 95% of Resellers used the default settings
• Fewer than 5% of Resellers branded the portal for their end users

Based on these findings and what we learned last winter, we concentrated on delivering the features people actually use.

We created a new spam quarantine that has two main functions:

1. Reviewing spam and, if required, releasing email from the quarantine
2. Managing safe and blocked sender lists

For Reseller management, the service has been integrated into the interfaces for the Tucows Email Service. At the domain and user level, Resellers can set up domain level blocked/safe sender lists, and even reject spam outright, if they choose. If Resellers choose to use the Tucows Email Service as well, filtering only accounts can be instantly upgraded to a full mailbox through the same interface with the check of a box.

We’ll provide more details about the specific changes and time frames in the new year.

In the meantime, here is a preview of what the spam quarantine will look like to your end users (click any of the images for a full sized view):

The list view shows all the messages caught in the Spam Quarantine:

In the message view, users will be able to see each spam message and take one of three different actions: tag the message as “Not Spam” (message is released from quarantine); add the sender to the Safe Sender list (messages from that sender will no longer be filtered) or add the sender to Block Sender list (messages from that sender will be automatically deleted):

Users can manage their Safe and Block Sender lists easily with the push of a button:

If you sell email from Tucows, you can expect to receive an email message  and/or a letter in the mail shortly about migrating to our new and improved email service. The message will direct you to a website to select an option for your migration. This site is chock full of information for you. It includes details about the features of our email service, documentation, information about how the migration is going to work and resources for you and your end-users.

We’ve been using the new email service here at Tucows for a number of months, and our team is confident it will exceed your expectations.

If you have any questions about email migrations, please contact your Account Manager or Support.

Last night I attended a meeting of the XP Toronto chapter, a usergroup of developers who use the extreme programming methodology to develop software products. I was part of a Product Management Panel with Saeed Khan (from Platespin) and Lee Garrison (from Riverdale Partners).

The purpose of our panel was to talk about what product managers do (and shouldn’t do), and how product management works inside an agile environment. For those of you who read the blog, you know that recently we moved to the agile methodology here at Tucows.

I got a lot of questions about why we moved to agile. People wanted to know what pain brought us to the point of realizing that iterative development was the way to go. Some of the reasons I shared  - we weren’t able to reach our goals fast enough; we took so long spec-ing a product that it was not salient when it got to market; and we couldn’t easily change mid-course.

We discussed a lot about what Product Managers should do. (Shouldn’t do included things like managing bugs, picking button colours on interfaces etc.) Most of the discussion about the role of product management came from the methodology we follow at Tucows (as did the rest of my panel - the Pragmatic Marketing approach. This is a market driven approach to product management. Its main mantra is to fully understand your market. To talk to your customers, your prospects, your competitors, and other market influencers to fully be able to articulate what the market needs to the customer.

When this is done well, it makes for a really great product.

When you combine a market approach with an agile process, I think you get the best of both worlds. One of my fellow panelists spoke about agile coming around out of frustration by developers, and pragmatic methodology of the frustration in product management, and I think that makes a lot of sense.  By understanding the market well, and responding to changes in the market, you can release something that really works for your customers.   The two releases that Tucows has coming out this month (email that you already know about and another coming shortly…I’ll leave that as a surprise) are real results of listening to the market, and adjusting our course as we learned more and delivering using the agile methodology.  It is really encouraging to be on a couple of those teams and feel the energy that comes out of a team working in an agile environment. It’s amazing to see people so committed to a release.

[Updated May 24th, 2007: We've included a link to a larger version of the screencast.]

Today is a big day. We’re thrilled to announce the next evolution of our Tucows Email Service.

Building on our experience providing millions and millions of mailboxes to service providers around the globe, we’ve made a number of innovations in this latest version that have resulted in a truly outstanding hosted email service.

The first is our back-end technology that has been designed to provide rock-solid reliability, the ability to grow to meet demand from our customers and their end-users, and for easy integrations.  You can read about “what’s under the hood” of our email service in an earlier post by Joey.

And of course, we’ve built our service from the ground up to meet the needs of service providers. It includes a web-based branding tool so a service provider can take our completely white-labeled service and make it his own. It also has additional tools for our Tier II Support team, meaning speedier resolutions, often at first call.

Our most significant development is in our new web mail interface (POP and IMAP are available too.) By working with Nitido, we have developed a web mail interface that competes with the leading free web mail providers.

I believe showing is better than telling, so we did a short screencast to introduce you to our new webmail. A small version appears below, and you can click here to see a larger version [QuickTime required].

You can read more about the new Tucows Email Service over on our site.

If you’re an existing customer, please log into the RRC or RWI  to gain access to our Test environment where you can evaluate the service. If you’re a new customer please contact our Sales team.

We believe service providers have a unique opportunity to offer our web mail to their customers. When matched with Tier I customer support it becomes a retention tool, not just an after-thought when bundling services.

We all know email is a highly-“sticky” service. Thinking about my own email usage, I have an ISP that I have used since university for my personal email (yes of course, they are a Tucows reseller ☺), I also have a handful of free web mail accounts that I use for personal email, subscriptions, and while traveling and away from my home and work computers.

Until the advent of next-generation AJAX-based web mail I always pop’d my email through Outlook or another local mail client. For me, regular use of web mail wasn’t an option. It was too clunky and slow and didn’t give me the features I needed to manage my personal information.

Of course that’s all changed. And I think Service Providers have an opportunity to use competitive web mail as a value-added service.

It seems like a no brainer to me. Service Providers are running email anyway, and by offering a competitive web mail experience, you can reduce your support costs by not having to explain POP or IMAP setups for every individual. You can just set them up, point them to the web and be there to support them if they have any issues.

The numbers show web mail use is on the rise. According to Charlene Li of Forrester, the number of users who use web mail once a week is up 4% from 27% to 31% in just one year. That’s a big jump, and I think we can attribute that to the increased use of the free web mail services.

As web hosting companies and ISPs look to retain customers, offering competitive value-added services like our web mail is a an opportunity to leverage leading-edge technology without making the upfront investment in development and ongoing investment in running an email system.

So, check it out, we're pretty excited, and we hope you like it!

Next month, Tucows will launch its new-and-improved hosted email service, which we built from the ground up to meet our customers' needs. I've been following this project from the very beginning, and over the next few weeks, I'll be posting all sorts of things — articles, podcasts, interviews and diagrams — on Tucows' email service, its features and the underlying technology.

In this first posting on email, I have a podcast interview with three key people here at Tucows about the new email service:

• Elliot Noss, Tucows' president and CEO
• Kim Phelan, Director of Product Management
• Rick Yazwinski, Director of Technical Operations and Planning

In the podcast, we talk about the importance of email, Tucows' focus on email and the technical and service advantages of our email service.

To list to the podcast, click the link below. The podcast is 18 minutes, 16 seconds long, just under 13MB in size and is an MP3 file that will play in any MP3 player, as well as iTunes and Windows Media Player.

Click here to play the podcast. (Right-click and select “Save as” to save it to your hard drive.)

We've had the podcast transcribed; the transcript appears below.

Podcast Transcript

[music]

Joey deVilla: Hello, and welcome to another Tucows Podcast. In this podcast, we'll be talking about Tucows Email and the new webmail feature. I'll be talking with CEO Elliot Noss, Director of Product Management Kim Phelan, and Director of Technical Operations and Planning Rick Yazwinski.

[music fades out; interview begins]

In the age of Web 2.0 and all sorts of new applications, why is this decades-old thing called “email” still important?

Elliot Noss: Well, I think that email, interestingly, has become, in orders of magnitude, more important than it used to be. One of the interesting things that we've observed over the last six months as email systems around the Internet have come under greater and greater pressure, both from load, but certainly, primarily from the massive amounts of spam that are now flowing through the system is that as there have been challenges around performance and deliverability across the Internet, you've seen businesses screaming in a way that, certainly, in my 12 years in this space have never seen before.

What has been clear to me is that the reliance that people, both individuals and businesses, now place on email in so many aspects of their lives has just taken it to a whole new level in terms of importance. So, just when you thought it couldn't get bigger, it did!

Joey:Why is Tucows, in particular, focusing on email?

Elliot: Well, this is something I've talked about previously, both on conference calls and on some of the earlier podcasts around some of the acquisitions that you and I did, Joey. The single largest providers of for-pay email, commercial email, of email that is central to people's Internet lives is delivered by service providers, and for service providers, there's really been a sea change over the last 12, 24, even as far back as 36 months.

For me, that centers around three things:

• One is, certainly, the massive increase in spam, where email is table stakes for service providers, and filtering spam was kind of a nice thing to have. Now, being able to do that at a massive scale, where 19 out of every 20 emails that pass through your system are garbage, has just become so much more difficult.
• The second is, now, the massive storage requirements. It's still the case, if you look around the Internet, that most service providers — most web hosting companies and ISPs — are still providing mailbox sizes of less than 100 MBs, or 100 MBs. That's a joke. There's no question that where Google, Yahoo, and Microsoft have taken us is to a world of — whether it's a GB, or two GBs, or five GBs, or certainly in our view — something bordering on unlimited storage has become an absolute requirement for email.
  
  By the way, that storage requirement is driven because people use email differently now. To go back to your first question about why is email still relevant, people use email as backup now; people use email as transport between themselves at the office and at home. People use email as archival storage in a fundamentally different way than they ever have. That creates this huge storage requirement for service providers, who typically could get away with some simple attached storage; now they're being driven into massive storage or uncompetitive email offerings.
• The third is around the fundamental changes we've seen in webmail over the last 12 to 24 months, where webmail has moved from a kind of crappy looking HTML that you used when you had to remotely, to, now, a place where the best webmail implementations are starting to rival desktop mail apps.

So, I think those three things have made it fundamentally different for service providers, and have fundamentally changed the economics and the calculus in terms of what service providers have to look at. As you know, we really like to find opportunities where we can help service providers, and supply them with things that allow them to be more competitive and more successful.

Joey: Earlier, you mentioned Google, Yahoo, and Microsoft, which brings up an interesting question, and that is: why would you go with a Tucows-based email service, when Google, Yahoo, and Microsoft are offering are offering it for free? Basically, how do you compete with free?

Elliot:So, there are two levels that you have to think about that at. One is the service provider level. I think it's a fundamentally different answer, but let's take that out to the end user, through the service provider. If you're a service provider, you need to think about why your customers are going to still want and take mail from you, and whether you care about that.

So, I start from if I'm a service provider, well, do I care if all of my customers are using Google, Yahoo, Microsoft, and, maybe, AOL for email. That's less likely in a service provider context. For me, the answer is clearly yes. I'm a fundamental believer that what service providers are in the business of doing is helping their customers use the Internet more easily and effectively. If we agree on that, and if we agree that email is the most important application in that usage, then to have that be supplied somewhere else — and when it's supplied somewhere else that means it's being supported somewhere else, or not supported at all — it's a fundamental disconnect, if I'm a service provider, between me and relationship I can build with my customer.

So, that's kind of the “OK, if I'm a service provider, why do I care?” Now, it's “Why should my customer care?” Why would my customer more want that to come from me — the hosting company or the ISP — than from Google, Yahoo, or Microsoft? There, I come down to roughly two or four important differences. First, those are, and will continue to be, generally, ad-supported models.

For me, personally, for the tiny increments in price that I need pay to get quality email from my service provider, for less than an expensive cup of coffee a month, for less than a cup of Starbucks coffee — one cup — put it in my monthly bundle, I can get email from my service provider with no advertising. That seems like an easy decision for me.

The second point is there's no question that a continuum that stretches from us through the service provider to the end user is going to provide, or should provide it we're all during our jobs, a significantly better user experience at a support and service level than Google, Yahoo, or Microsoft can provide — possibly, can possibly provide.

I say that because if you're a service provider, overwhelmingly it's the case that servicing and supporting that end user, helping them use the Internet, is what's in your DNA, and that's not what Google, Yahoo, or Microsoft are about. They all do great things, and do lots of them, but providing one to one support is not one of them, and it is for the folks that I'm talking about.

That's the second thing. I think that the third thing is one that we're going to start to see and hear of going forward, which is the fact that nobody has yet figured out how you migrate out of these services. One of the things, from my perspective, that people aren't making enough of out of that whole PhotoBucket/MySpace thing is that, boy, when you have free services, you probably don't own and control your data to nearly the extent that you should or will want to. That's, unfortunately, one of those things that you won't really feel the pain around, even though you care about it, until it's too late or until you have some sort of negative incident.

But, boy, if you're paying a service provider for email, and it's commercially provided and supported, your control of your data is going to be at a way higher level than it will be with a Google, Yahoo, or Microsoft, even though nobody's really figured out how to port of those places yet. So for me, those are the three big reasons.

Joey:Kim, it looks like you've got a fourth item that you have to add to Elliot's list. Go right head and tell me about it.

Kim Phelan:Well certainly, I realize that Microsoft and Google have announced the ability for people to use their own domain names with those tools. But, that's another aspect that I think about for the service provider relationship with their end customer: to be able to help along with that path. They've got names; they can then also bring that together with their email. Things like when we bought NetIdentity last year, that was exactly why we went there, that people have an online identity, and the loyalty to that online identity is huge. To have the service provider be able to weave that story and provide that service to them, I think, is great.

Joey:All right. Well Kim, you're the Product Manager for Email; tell us about the highlights of Tucows' Email Service.

Kim:All right. Obviously, with the background that Elliot provided, we really wanted to look at our email offering and build a new offering that really made sure that we were supporting the, obviously, desktop users that exist today, who are using those clients, but also really allow our service providers to compete against the Googles and the Yahoos of the world by a really great webmail experience.

So, we're really looking at how to make webmail not just something you have to use when you're traveling, but something want to use. Just like Gmail has changed how we look at webmail, we want to do the same thing but provide it in a way that's really centered around how the service provider wants to deliver. So, whether that's brandability, with Tucows being totally in the background, but just email that works and is really competitive and works inside their existing infrastructure.

Joey:Rick, as the tech guy, tell us a little bit about the underlying technology — the hamsters on wheels behind all this.

Rick Yazwinski:Our new email product is really a combination of the best of breed — hardware and software platforms that we could put together into the solution. From a hardware perspective, we have all the big names that you would expect to see: NetApp for storage, Sun with their 64-bit AMD Platforms, big IP load balancers to distribute the traffic across our farms.

From a software perspective, we've really looked at the solutions that we've run in the past, both the Critical Path hosted and the CommuniGate one previous, and seen what they did really well and where we had problems with those. From the hosted platform, we took some of the really leading-edge stuff that were doing, merged it with some of the Tucows legacy platform products that we had, then finally layered on a set of componentry from the open source realm that is being used for email delivery world-wide. With this combination, we have a solution that is really robust, very scalable, and we're very excited about it.

Joey:So Rick, all this great underlying hardware and software technology; what does it provide in the end?

Rick:I think the big three things that I would call out, specifically, in roughly the order that our customers would experience them, would be:

• First, the ease of integration. Our new platform is very easy to start communicating with, and to start creating users. We've scaled it and done a significant amount of testing around rolling out very large user bases — multi-million user bases into the mail solution. Where, historically, that might take days or weeks, it now takes hours. So, to get a customer going in the platform is now a very simple and quick operation.
• The second high-level item that I would touch on would be deliverability. We know that today, in the real world, people use email as they do conversations. They expect mail to be delivered; they expect it to be delivered in near real-time. Paging systems, doctors appointments, meetings at the office, interoffice communication; all those types of things are happening within email, and people just have the expectation that it happens. We found that with email it's very, very easy to disappoint. Five minutes of delay with an email translates into customer disappointment. What we're trying to build with this solution, and what we will build with this solution is excitement and delight.
  
  We've done this with that software/hardware layer that we were talking about, so the technology layer is very important. We also do a lot of research around optimizing mail flow, and getting that expectation met in the very, very large mail clusters that we're talking about.
• The last point that I would talk about is performance in the large, and this speaks to the power users that we're starting to see come on and using email, as Elliott was saying, as an archival means — as a way of tracking their history, as a way of documenting a company's past or their past in their department. At Tucows, in our operations department, we had guys with in-boxes with 10,000 messages in them.
  
  This exposed a challenge to us that we really didn't expect when we were looking at this problem space. It took a reasonable amount of work to work around; with some smart use of caching and some technologies that I'm not going go into here, we managed to overcome those in really interesting ways that give the end users a really clean, fast, and responsive experience.

Joey:Kim, beyond the nuts and bolts, the hardware/software combination that actually makes the email service go, what else is there that Tucows provides?

Kim:Well, Tucows provides — it's a hard to quantify benefit, but it really comes down to the human side of things. In the last six to 12 months, we've certainly learned a lot of lessons around anti-spam and how it's really changing. The volume is just exorbitant now.

Part of it is having good filters, and that should be a non-starter. But the second half of it is the human part, which is how do you deal with those different attacks. When you have all of these mail providers at war with each other, trying to the best service ever, there's always somebody blogging someone else.

Tucows actually has two different teams that deal with those types of issues:

• We have an abuse team, and they have great relationships with all of the mail providers and any of the spam list providers as well. It's up to them to actually work with those providers to make sure that any issues are eliminated.
• Then, the other side of it is our compliance team. We have some pretty extensive experience because of our domains background. Whether it's regulatory issues, legal issues, or even law enforcement issues, we take that same type of experience with our compliance group when it comes down to email, as well. So let's say one of your users has a phishing attack related to your email, we will certainly be reaching out to you as a service provider to help you with that problem and work through it, instead of you having to deal with it on your own.

So, it's that human side of things — good technology is great, but you also have our support, as well.

Elliot:It's our experience that the human side is what has the greatest impact on deliverability, and deliverability is single largest factor as it relates to support calls. I think that's such a “what's in it for me?”

[music fades in; interview ends]

Joey:This has been a podcast about Tucows Email Service and the new webmail feature with CEO Elliot Noss, Director of Product Management Kim Phelan, and Director of Technical Operations and Planning Rick Yazwinski. I'm Technical Evangelist Joey deVilla, your host.

For more information about Tucows Services, please visit our services website at services.tucows.com.

Thanks for listening.

Those who know Tucows probably know us as either a) a download site or b) a domain name company. Both of these are of course true, however providing email services to ISPs and hosting companies is now a big part of our business and one of our focuses going forward. We provide both a fully hosted Email Service, where we host webmail, SMTP, POP, IMAP, filtering, etc. and an Email Defense Service where we do the spam and virus filtering, and then forward the clean mail to our customer’s mail server. We currently have millions of paid-for mailboxes. In an effort to create more awareness about what we do and to generate some discussion on the spam topic, I wanted to give you some insight into what we’re doing and get your opinions/thoughts on what you’re seeing and hearing from your customers.

Since September 2006, we’ve seen a 100% increase in email attacks and spam hitting our email services. In August we had just over 1 billion email connections to our hosted Email Service and Email Defense Service systems, which was relatively ‘normal’. However, what has happened since then is something that I don’t think we or anyone else has accurately projected. Steadily increasing since September, November connections topped out at around 2 billion. This certainly kept our 24X7 Abuse Team and our systems hopping. What we saw is certainly in line with what everyone else providing email services has seen, although few of the other big players publish their numbers. A sample stat is that the Anti-Phishing Working Group (APWG) reports that the number of distinct spoof Web sites rose 52% in October 2006 to a record-shattering 37,444, up from 24,565 a month earlier.

In order to try to keep up with the mounting attacks, we added more IP based filtering at both the network and application layer to block connections at the door, worked diligently to improve filtering rules/ techniques and spent $1 million on our email infrastructure.

Even after doing that though, we’re not yet totally happy with how well we’re defending against attack. Although we are definitely blocking a ton of spam and keeping many people happy, because of the significant overall volume increase and new tactics employed by spammers with image spam, many end users are seeing more spam in their inbox than they were used to.

One question I have is what is an acceptable accuracy rate? Do end users expect 96% catch-rates with zero false-positives OR do they base their acceptance on how many spam get through (not the percentage that are caught). The ‘industry’ generally only talks about catch-rates and accuracy, but more and more I think that end users only really care about how much spam gets through to their inbox and everyone has their own personal threshold. The people I’ve talked to tell me that they don’t care nor do they find it acceptable that the spammer has launched their annual fall spam campaign and this will result in their mailbox having 10 spam instead of the normal 5 spam. Sure, deleting another 5 messages isn’t a big deal to some, but at the end of the day most people just want it to go away. For me personally, I have about 100 messages a day that are put in my spam quarantine, but if 5 messages get through the filter, I’m not happy.

Something almost all end users don’t realize is that we’re blocking a lot more than they see even if they have a spam quarantine. Even though it looks to me as if filtering caught 100 messages today, in fact for every 100 put into quarantine many more have been blocked right at the gate because of IP filtering/connection management mechanisms. I can tell you that on average about 52% of connections are blocked by the IP filters/connection management techniques versus 21% of connections that is blocked by the content filters. A good chunk of these blocked connections won’t be directed at the mailboxes we host, but are rather Directory Harvest Attacks and other attacks directed at the domain. The fact that the service they use is doing much more than is visible – again, they probably don’t care. However, the cost of filtering mail is only increasing and the more we move toward blocking mail at the door and not saving everything in a quarantine, the less visible spam filtering value end users will have in what the service provider is doing for them and that’s assuming that the end user even looks at their quarantine today.

If it’s true that end users really only care about how much spam gets through to their inbox, then we all have some work to do. If people care, we should do a much better job of educating (and for Tucows it will need to start with many of you, our partners). We want to be able to demonstrate to those of you that only outsource your filtering to Tucows that we are doing a hell of a lot of work to protect your email infrastructure by giving you visibility into all the attacks that we’re blocking. And after that, maybe you’ll think about outsourcing the pain of it all (email and filtering).

So tell us your thoughts… What is an acceptable accuracy rate? Are your customers noticing this influx? How are you dealing?