Educause Security Discussion mailing list archives

Re: Email Forwarding


From: Joe St Sauver <joe () OREGON UOREGON EDU>
Date: Fri, 18 Feb 2011 08:04:51 -0800

Geoffrey mentioned:

#At Wayne State we do allow forwarding, and this has indeed caused us grief on
#occasion, but it's unlikely we'll turn it off any time soon. I maintain a blog
#on internal IT-related things, and suggested, a few months ago, that we forbid
#forwarding. You can  read the comments--they are instructive: 
#
# http://blogs.wayne.edu/proftech/2010/are-you-part-of-the-problem/ 

Looking at that article and comments, I'm seeing two key themes, I think:

-- forwarding was causing problems for Wayne State because forwarding
   was happening pre-filtering, and when spam was forwarded to third
   party providers, and then reported by users, it was "charged" against
   Wayne State, even though all you did was dutifully forward the user's
   mail as they'd asked you to do

-- some users preferred third party accounts because of things like 
   excessive amounts of "intra-spam" to which they'd been involuntarily
   subscribed

We dealt with the first issue in part here at UO by offering users the
ability to forward AFTER spam filtering had happened (e.g., via 
procmail rather than via a traditional .forward file). That approach
really knocks forwarded spam down to trivial levels, assuming you have
an effective filtering solution in place. 

The second issue, intra-spam, is one that each site needs to wrestle
with themselves, but I think policies that mandate either (a) confirmed
opt-in lists only, or (b) approval by a designated very senior person 
(for rare involuntary everyone-gets-this-one-whether-they-want-it-or-not 
mailings) can do a lot to eliminate issues with unwanted intra-spam.

Regards,

Joe

Disclaimer: all opinions strictly my own


Current thread: