Using MXRate

Frequently Asked Questions

Is MXRate a blacklist?

MXRate is not really a blacklist in the traditional sense. Our system analyzes data submitted using automated procedures. It calculates a probability score based on the overall message sending pattern of any particular server and that is used as a basis of an opinion as to whether or not the address is a source of spam. What we do is publish a recommendation based on that opinion. Certainly, we can publish a recommendation that the message be blocked or highly penalized, however we can also recommend that it simply be treated with suspicion, or even treated as a known source of legitimate mail.

It is important to note that the MXRate service itself does not block email, nor is it capable of blocking email. It is simply a data collection mechanism that calculates what we believe to be a completely truthful and impartial opinion and recommendation based on the data received. How this recommendation is used is solely at the discretion of the ISPs or mail system administrators that decide to use our recommendations in their anti-spam configurations.

Why is MXRate different than other blacklists or DNS databases?

Rather than compiling a list of any server ever suspected of sending spam, MXRate focuses on active spammers. Say, for example, someone signs up for an email account with a small ISP. They immediately start sending spam and before the ISP discovers it, the spammer has sent out a couple of hundred thousand spam messages. Of course, once the ISP's mail administrator is alerted, the account is terminated and the spamming stops, but usually not before the damage is done. The ISP may now be listed on several spam databases and have difficulty getting mail delivered. Plus, anyone who has ever had this happen knows that it is extremely difficult to get your servers address removed.

MXRate does this differently. First, we do not accept subjective spam reports. Secondly, not only do we track spam, we also track legitimate email. This allows us to evaluate the current sending patterns of a mail server. In the example above, the ISP would undoubtedly have some statistics being maintained by us on the ratio of legitimate messages to spam messages, and their recent frequency. So while the spammer might have caused a temporary "block" recommendation, this would probably only last a few hours after the spamming stops.

So, in other words, our intention is not to provide a database of addresses of anyone who has ever sent spam, it is to provide a database of addresses currently sending spam.

Who decides what is recommended to be blocked or not?

Actually, no one. There is not a single human being involved except for the programmers who maintain the systems and databases used in evaluating the data. We receive data from remote servers throughout the day that contains the server address and the score for each message the server receives. The score is a numeric representation indicating how "spammy" or "un-spammy" the message was. It is not subjective and the same basic rule sets are applied to every message regardless of where the server is located. This allows us to maintain accurate data on each server (address) reported, and apply calculations evenly and consistently and publish a recommendation based on actual statistical analysis.

Are blocks or ranges of addresses listed?

No. Each address listed must have been reported to us individually and each recommendation is calculated on actual email traffic reported as originating from that specific address.

How can I report spam?

We do not accept spam reports. In fact, we would have no way to do anything with them even if we did. The MXRate database only contains data that has been computer generated, compiled, and analyzed. This ensures that each message is quantified equally, without involving any human subjective judgment whatsoever.

My address is listed. How can I get off the list?

Stop sending spam. Actually, this sounds blunt, but it is basically the case. The MXRate database is designed to be dynamically self correcting. Say for instance, you have users on your system that are infected with a virus or worm that is sending spam. Or possibly you have a real spammer you do not know about. This could cause your servers address to trigger a block recommendation. We understand that this may seem unfair from the server operators point of view, however from a technical standpoint, the block recommendation would be justifiable. After all, spam is coming from the server, and in order to get a bad recommendation, it would have to be significant. In these cases, the servers recommendation will "improve" after the spamming stops. Typically, after spamming ceases from any particular address, it will fall from a block recommendation to suspicious within 3-4 hours, and to neutral several hours after that.

How often is MXRate updated?

The MXRate database is updated every 30 minutes, 24/7. Reports from remote Alligate servers come in in 60 minute batches constantly throughout the day. This means that maximum age of any single item in a report batch would be 90 minutes before it is posted to the user downloadable database. Each time the update runs, the recommendations for each address are recalculated, new MXRate database files are generated and updated for Alligate and MXRate users.

How long are addresses listed?

Addresses are listed as long as they are actively being reported. Any address with no activity (good or bad) for 30 days is purged. However, the recommendation may change hourly. The key point here is that no address is ever permanently recommended to be blocked or treated as a good sender. The recommendation we provide is based solely on historical and recent activity.

What do the different "recommendations" mean?

Block - This means the message is coming from a source that, in our opinion, has been determined to send a considerable amount of spam recently, usually within the past few hours. These messages should be penalized as you feel appropriate. This recommendation means that the probability has been calculated to be 80% or higher.

Suspicious - This means the message is coming from a source that, in our opinion, has been determined to send a considerable amount of spam, but either the level of spam activity, the frequency, or the amount of time since the last report does not allow us to confidently recommend a block. These messages may be penalized to a lesser degree than block messages if desired, or you may use this recommendation to trigger additional testing. This recommendation means that the probability has been calculated to between 50% and 80%.

Good - This means the message is coming from a source that, in our opinion, has been determined to send a considerable amount of mail that has passed spam checking. We also calculate the number of false positives reported for a particular address as well as the number of users that have whitelisted the address. These calculations are used to determine the overall reputation of the sender. Although we refer to this category as "Good", this does not necessarily mean that unwanted email cannot come from the source, and this should not be considered a whitelist. This recommendation is based on a statistical analysis of the history we have compiled on the particular sender. Generally this means that we have found that the sender sends a high percentage of legitimate email that users want to receive. If your anti-spam system can support it, we would recommend that a counterweight (negative penalty) be assessed to messages coming from these addresses.

I run a mailing list or commercial mailing service. How can I report I am legit?

We have absolutely no interest in maintaining inaccurate data. If you are a mailing list or legitimate commercial mailer, then you are well aware that mail delivery is a problem. Since all of our data comes from users of our commercial anti-spam gateway product, Alligate, we also have an interest in ensuring that your mail is deliverable. We provide the pattern filters that make the determination as to how spam is detected for Alligate, and we have provided mechanisms for counterweighing mailing lists and commercial delivery agents. Please contact us here to report your service.

What is Alligate?

Alligate is our high performance anti-spam gateway product for Windows servers. For more information, please click here.