Carroll College, a private institution in Waukesha, Wis., services 7,000 e-mail accounts that receive approximately 1 million messages per month. The college's commitment to freedom of expression and to privacy precludes the use of an outside anti-spam service to filter all this mail, as does the cost of such a service, which is why Carroll's IT department chose to go with an appliance-based anti-spam solution.

Carroll College students, faculty and staff use a wide range of e-mail clients, including Pine, Qualcomm Inc.'s Eudora and Microsoft Corp.'s Outlook. E-mail at the school is run on Windows, Unix and Linux systems.

John Arechavala, Carroll College's network and systems manager, said he will spend just under $1 per e-mail box per year to provide anti-spam services using Solinus Inc.'s MailFoundry appliance, which he installed in October 2003. And he expects the price to drop to 20 cents per mailbox per year when he can count just the license and maintenance fees.

Arechavala didn't factor in staff time when figuring costs, but it was clear during an interview with eWEEK Labs that he didn't consider the approximately 90 minutes per week that he spends working with the system to be a problem.

"Mostly, we're just checking mail queues to see if there is a slowdown," he said.

Arechavala is an administrator who likes statistics, and he gets plenty of them from the MailFoundry anti-spam appliance, which is based on a Sun Microsystems Inc. Sun Fire V100 rack-mountable system.

Junk mail captured by the MailFoundry appliance is automatically purged after five days in the system—one of the most aggressive spam-junking policies eWEEK Labs has encountered. End users do not have access to quarantined e-mail. Arechavala shares the philosophy that looking at filtered spam is just a waste of time. "Any cost savings from junking spam in the first place are lost if users just spend that time looking over their junk box," he said.

Carroll College has just two IT staffers whose responsibility is e-mail, among other things, so the college's policy limits requests for e-mail exceptions to faculty and staff. Carroll College mail is blocked by rule sets provided by MailFoundry, in addition to 53 custom filters that Arechavala has written.

Indeed, the MailFoundry appliance requires more administration time than an outsourced service would. But the trade-off for Arechavala is privacy and security.

Click here to read about how other schools are fighting spam.

Although eWEEK Labs has never heard of a security breach at a managed anti-spam company, the risk is there. Organizations that cannot tolerate the chance of having sensitive e-mail scanned by an outside company should consider either an appliance-based system such as MailFoundry or a software-based tool that integrates directly with the mail server, such as Sunbelt Software Inc.'s iHateSpam.

When a spam message makes it through MailFoundry, the recipient of the e-mail gets instructions from the IT department about how to gather e-mail header information so that a filter can be adjusted to catch the junk. This happens rarely, said Arechavala.

However, during the year that the MailFoundry appliance has been in place, Carroll College experienced a couple of spam spikes when changes to the product caused it to miss some Korean-language spam.

Despite this hiccup, Arechavala is committed to using the product because it allows him to control every aspect of the spam battle while also accommodating the wide-ranging needs of his users. In addition, he said, MailFoundry's low operating costs and ease of administration make it a bargain anti-spam tool—an important consideration given tight IT budgets.

The icing on the cake for Carroll College is that MailFoundry uses a Sophos plc. anti-virus tool that augments the Symantec Corp. Norton AntiVirus system that the college provides to all staff and students. By filtering both inbound and outbound e-mail with anti-spam and anti-virus tools, Carroll College has avoided many malicious code outbreaks that have seen the light of day at other organizations.

Technical Director Cameron Sturdevant can be reached at cameron_sturdevant@ziffdavis.com.

Check out eWEEK.com's for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog.