Tutorial - how to protect your email inbox from spam

Hi guys

In this tutorial i will share with you different solutions how to protect your mailbox from spam.

Requirements:
- You are the owner of the domain
- You have access to the DNS records

Case:
The problem is, the most webhosting providers use as Antispam solution Apache SpamAssasin
The settings and filters are very limited and many Spams come inside of your Mailbox. If you change the score rating, you will have many false positives


So what can you do?

I share with you 3 solutions where i have very good experience:

1. ProtonMail - they use Barracuda antispam appliances
Protonmail use Barracuda which are very powerful antispam appliances.
If you buy a Plus account, you can connect your own Domain and they filter all Spams very efficient.

Downside:
If you use your domain for an online store and need SMTP to send the customers e-mails, this solution does not work because Proton encrypt all emails and use Proton Mail bridge to translate the SMTP connection.

This solution is only for peoples which have a static website and publish an E-Mail adress for contacting

Config Tutorial:
https://proton.me/support/custom-domain
2. Cloudflare Area 1 Email Security - in combination with Microsoft O365 or Google Workspace
If you have a professional company and use Google Workspace or Microsoft O365, you should activate the free solution Cloudflare Area 1 Email Security
This combination is very powerful!


Config Tutorial:
https://www.cloudflare.com/zero-trust/products/email-security/https://developers.cloudflare.com/email-security/deployment/
3. Spambarrier Cloud Antispam (free)
This solution is a secret tip ;-)
The website Spambarrier(.)de is only in german but you can translate it with Google Translater

Step 1: create a free account and click on the activation link
Step 2: add your domain

Step 3: add the IP of your webhosting/email server

Step 4: verify your domain with txt record or email verification

Step 5: add in your DNS records the MX records mx1.spambarrier.de & mx2.spambarrier.de

Step 6: now Spambarrier filter all Spam/Phishing & Malware E-Mails

Price: this solution is free. If you buy a pro account, you will have a higher quality of filters but for the most users are the free version good enough


If you like my tutorials pls give me a like and follow me for more tutorials in the future

protonmail is a honeypot (I believe that's the technical word) and will disclose the content of ALL of your emails with the FBI (and probably with the Interpol and Europol, too). Just saying

Also, I have no idea what the purpose of this tutorial is because I've not received a single spam in 15+ years of using dozens of hosting providers, but maybe someone finds value in it?

Please know that I'm not trying to attack you for creating this tutorial and I am also not angry / mad at you for creating it, I just expressed the first thoughts that popped into my head when reading your tutorial, but my mind is oftentimes scattered all over the place when reading stuff, so ignore me

tazarbm said:

protonmail is a honeypot (I believe that's the technical word) and will disclose the content of ALL of your emails with the FBI (and probably with the Interpol and Europol, too). Just saying

Also, I have no idea what the purpose of this tutorial is because I've not received a single spam in 15+ years of using dozens of hosting providers, but maybe someone finds value in it?

Please know that I'm not trying to attack you for creating this tutorial and I am also not angry / mad at you for creating it, I just expressed the first thoughts that popped into my head when reading your tutorial, but my mind is oftentimes scattered all over the place when reading stuff, so ignore me

Click to expand...

thank you for your feedback.

No Protonmail is not a honeypot and will not share your data. I will tell you 4 different perspectives why.

Swiss Law & Court:
A Professor at my university works for Proton and we had a discussion with him about whether Proton shares data with the police.
Proton is a Swiss company and is subject to the law of Switzerland. If the FBI/Europol wants data, they must submit a request to Swiss law enforcement.
The Swiss law enforcement need an authorised approval of the Swiss court, which very rarely happens due to lack of evidence.
https://proton.me/legal/law-enforcement
In Switzerland the personal data protection law of a citizen is considered very high.
To illustrate this in practice:
The swiss peoples voted in a direct democracy voting that a person can send everytime a request to the swiss intelligence and ask which data are collected.
So i can send everytime this letter to the swiss intelligence and they have to tell me in which database are deata collected about me.
http://www.grundrechte.ch/gesuch-um-einsicht-in-die-staatsschutzakten-des-ndb.html
If im not happy with this i can go to the swiss court and sue the intelligence service. In no other countries in the world is this possible. In switzerland the power is by the population and court and i can everytime sue the government, politician or police if they violate my privacy because in the Federal Constitution is the data privacy one of the highest right.

This is the reason why so much Data, E-Mail, VPN and hosting companies register the head quarter in Switzerland.

*Addition: in 1. September 2023 Switzerland have a new data privacy law. Every companie and government need to realize a data privacy by default and data security by default strategy and solution.

Technology:
The most security comapnies in switzerland like Threema, Tresorit, Proton etc. follow the zero knowledge strategy. So they are all the time not the owner of the private encrypted key.
In the past Proton had shared only the IPs to the FBI from the source access to the E-Mail boxes/web login because the court tell Proton to give all data what they have. But the most cyber criminals use VPN because the police can see also in the Logs of the ISPs the source and destination IPs. But Proton can not give any informations about the e-mail content because this is encrypted and the have not the private key. If you reset the passord or your account, all data would be lost.

Police:
The most countries have not enought cyber security police agents. As example: switzerland have in Zurich only 10 cyber crime police agents. But every week switzerland have 1000+ cyber attacks. So the police can focus only to big cyber criminal groups because the ressources are limited.

You can check the Law enforcment report 2022 of Microsoft. The requests are very low because the most countries have not enough cyber crime police agents.
https://www.microsoft.com/en-us/corporate-responsibility/law-enforcement-requests-report
Reputation:
Companies like Proton wanna not be a service for criminals. They wanna give data privacy for professional companies, journalist or peoples like me which are not criminal.
So its very important that the e-mail server have a good reputation. Otherwise its not possible to send users of GMail or Outlook e-mails without landing in Spam inboxes.
So if you are doing bad things with proton, they will kick you out and thats fine for me.

Concerning Antispam:
If you have premium domains, expired domains or niche domains, you will have a lot of Spams/Phishin/Malware by default.
As example: i have a premium domain in the finance niche and every day cyber criminals send me a lot of spam and malware because they wanna infect my company and they think im a financial company with a lot of money.

things might have changed in the meantime (although I still doubt it), but these 2 vids - although over 1 year old - say otherwise

i have check the videos and i dont know how much fear we should have from the NSA if we use own encrypted private keys.

I think the most peoles think the CIA/NSA are very powerful but if you look at the CIA leaks on Wikileaks, the CIA agencies cook with the same tools and technologies like cyber criminals.
They have done very poorly in some cases. Some VMs had the standard password 123456. I mean really? CIA create servers for hacking and the admins give the password 123456?
The same also with the CIA Hack (Social Engineering)

Or since over 10 years many US army peoples send secret data to @army.ml (the correct domain should be @army.mil)
https://www.bbc.com/news/world-us-canada-66226873
Proton use PGP which is a standard. Many ethical hacker & cryptologists try to crack encryption standards like AES, RSA etc..... and you can send encrypted e-mails also with your own keys.
https://en.wikipedia.org/wiki/Pretty_Good_Privacy
So i think if you are the owner of the private keys and only you have access, your data are very good encrypted and protected.

tazarbm said:

things might have changed in the meantime (although I still doubt it), but these 2 vids - although over 1 year old - say otherwise

Click to expand...

i have found also this interesting post

ok, I give up. I've pestered you long enough with info that might be outdated anyway, I'm sure you know better

tazarbm said:

ok, I give up. I've pestered you long enough with info that might be outdated anyway, I'm sure you know better

Click to expand...

sry I hope I didn't scare you I am not omniscient and I also like to learn from other people, so please do not hesitate to share informations and your knowlegde with me in the future^^

What I can say in conclusion. I think we don't have to be afraid of the police and intelligence as long as we are legal and pay taxes

CyberCommander said:

sry I hope I didn't scare you I am not omniscient and I also like to learn from other people, so please do not hesitate to share informations and your knowlegde with me in the future^^

What I can say in conclusion. I think we don't have to be afraid of the police and intelligence as long as we are legal and pay taxes

Click to expand...

we don't have to be afraid of anyone and anything, fear is neither logical or normal. But being cautious is good...

And you didn't scare me, don't worry! I just blurted out stuff that popped into my mind, as I said in my 1st comment, your tutorial really reminded me of the 2 vids I shared because - at that time when I've watched them (over an year ago) - I've been pretty impressed by them, that's why your mentioning of Protonmail triggered them in my memory...

Anyway, I've made too many replies that provide no value, and this infuriates me. I'll stop replying now, but hopefully people find your tutorial as dope as it seems to be ... Cheers!

Thank you for the tips.

Excellent write up .
I have a website. So, it will be very helpful for me and my team. Thank you and best wishes for you

There are much knowledge from this .
Thank you for sharing the great tutorial dude .

Inboud spam is not a big obstacle to overcome these days, any self hosted solution has some sort of filter that you can tweak and train that will eventually reduce the amount of spam that you receive. Even the free ones - some way to aggressive even. I always say that everyone using the free email providers Microsoft has - like MSN don't really have a working email, because of their insane mail blocking policies..

gpetkof said:

Inboud spam is not a big obstacle to overcome these days, any self hosted solution has some sort of filter that you can tweak and train that will eventually reduce the amount of spam that you receive. Even the free ones - some way to aggressive even. I always say that everyone using the free email providers Microsoft has - like MSN don't really have a working email, because of their insane mail blocking policies..

Click to expand...

I think the experience with spam varies by country and language. Apache SpamAssassin supported in the past only English. Since the Version 4.0 (released in 2022) more languages are supported.
https://svn.apache.org/repos/asf/spamassassin/trunk/build/announcements/4.0.0.txt
But its all the time a cat and mouse game. In my country i become many Spams because the Spamers use hacked E-Mail Accounts (not E-Mail spoofing) from real companies with a good E-Mail server reputation. The newest attacks was that they send E-Mails only with pictures and if you have a high score you block also a lot of legitime E-Mails. if you have in the settings low score a lot of spams come in the inbox.

Many webhosting companies (leaders) have not block Spams like this. I mean it is obvious (Viagra) ;-)
I think they had a problem because the Spam-E-Mails was in german and not english.

for those people who want to protect a company domain the VPS provider Edis.at offer Baraccuda Antispam Appliance (1 Domain / 20 Euro per month)
https://www.edis.at/en/hosting/spam-firewall

New Update:
i have also good experience with this App but it cost money.
https://spamdrain.com/