# Anti-Spam Strategy Options — advmfr.net

Decision note for the client. Context: recurring virus-infection attempts by email on a
cPanel/o2switch account hosting 87 mailboxes. Three realistic strategies exist on this
platform; they are compared honestly below, including the one we advise against.

## Option A — Score-based global filters + central quarantine ⭐ Recommended

Server-wide rules on the SpamAssassin score (which analyzes the *decoded* message, so
Base64-encoded malware cannot hide from it). Suspect mail is parked in a central
`Quarantine` folder reviewed by the administrator; a rule only graduates to permanent
deletion after 7 days with zero false positives.

- ✅ Zero mail loss by construction (quarantine-first, whitelist on top).
- ✅ Zero impact on the 87 users — nothing changes in their daily flow.
- ✅ Centralized: one place to review, one place to tune.
- ✅ No outgoing side effects (no bounces, no reputation risk).
- ⚠️ Requires ~2 min/day of admin review during the 7-day observation window,
  then a quarterly purge.

## Option B — BoxTrapper (challenge–response) ❌ Advised against

Every unknown sender receives an automatic "please confirm you are human" email and their
message is held until they click.

- ❌ **Backscatter**: spam senders are spoofed, so confirmation requests bombard innocent
  third parties — this is what gets a server blacklisted. (Same mechanism we are currently
  removing from the legacy filters.)
- ❌ **Silent mail loss in practice**: o2switch's own documentation warns that many
  providers filter the confirmation emails — the legitimate sender never sees the
  challenge, and their message sits in a queue nobody watches.
- ❌ Per-mailbox queues: 87 users would each have to monitor their own trapped-mail queue.
- ❌ Hostile to normal business flow: every new customer/supplier contact hits a wall.
- ✅ Only upside: very aggressive against low-effort spam. Not worth the above.

## Option C — Status quo (Spam Box only)

Keep only the o2switch antispam sorting spam into each user's Spam folder.

- ✅ No admin work.
- ❌ Under-scored malware keeps reaching inboxes (the current problem).
- ❌ The three legacy filters keep sending backscatter bounces (reputation damage)
  — at minimum those must be fixed regardless of the option chosen.

## Recommendation

**Option A**, with the legacy-filter cleanup done in all cases. Option B is listed for
completeness: both o2switch's documentation and deliverability practice argue against
challenge–response systems on a business domain.

Full deployment detail: [runbook.md](runbook.md) ·
[deployment plan](https://claude.ai/code/artifact/491d250f-a613-4e6e-81fa-5b374dce1f02)