Spam Filters & SSL: What Should I Do?

We got a great question in Ye Olde Mailbag today from Jean-Claude in Montreal, Canada.

He asks,

I installed Vipre. Their SPAM FILTERING does not support SSL connections.

"Here is a note from their text:

"NOTE: Spam filtering will only function for POP3 configurations set to port 110, by default, for incoming email. SSL connections are not supported and will cause mail to stop flowing.

"Is it a big thing?

"Thanks.

Here was my reply:

It’s definitely a trade off.

The reason why it can’t support SSL is because the SSL encrypts the messages as they traverse the wire between your PC’s email client (i.e. Outlook) and your email provider’s mail servers.

Thus, VIPRE would be looking at gobbletygook nonsense and couldn’t do its job.

This is what the transit path looks like for an email:

[ Outlook ] <===> [ VIPRE ] <===> [ Internet ] <===> [ Mail Servers ]


The problem is the encryption happens like this:

[ Outlook ] <======================================> [ Mail Servers ]

Thus, VIPRE is blind to what Outlook and the mail servers are doing when SSL is enabled.

So, the question is this:

Do you have a spam problem or does your ISP provide reasonably good spam prevention / filtering?

If you do have a spam problem, spam filters like the one in VIPRE (which is very effective) are a reasonable choice, but they do come at the cost of having an SSL encrypted connection.

If you don't, I’d suggest you leave the SSL enabled and disable the spam filter.

Here’s why: with SSL disabled your email sent in clear text to the mail servers, and, more importantly, so are your username and password.

You should always act as if your emails are plain to see anyway, but there’s no reason not to protect your email username and password if you can.

Oh, and be sure you’re using a COMPLETELY different password for each of your email account[s] than you do anywhere else, especially onilne banks, credit cards, etc.