Google stopped scanning their Google Apps email back in 14.

We use Google Apps at work, works great

Perhaps you could educate me. I have found the spam filter to only be marginally effective. Many of the spam emails have fake return addresses, so they can't be flagged and make any difference.

Do you view them one at a time, so the domain name can be put in your blocked domains list? I'm not even sure if that has any effect, with fake email addresses.

I have just relied on the spam filter as configured by Mindspring.

You may be having a problem due to someone else who you have had email correspondence.

If they allow their system to become infected with some malware it can grab the contents of their contacts list/address book and start sending crap.

I don't have much personal correspondence and the folks I do correspond with have must be smart folks who keep their system clean.

Wish I had more information for you.

Frederick

Filtering for specific From: or Return: addresses is not very effective, however, a "pattern search" (sometimes known as a "wild card search") can be very effective. For example, searching the Subject: line for "*Dr Oz*" will detect "Dr Oz" anywhere in the subject. The "*" is usually known as a "wild card" and will match any character or string of characters. (except the "*" character, of course) The above pattern could match 'abcd..z123..00Dr Ozabcd..z123..00'.

Somewhere in your email is an option to "Display Source". This will bring up the raw text of the message. As expected, the top portion is called the "Header". Here, there are notes about how the message is formatted and where it has been. It is customary that, as a message is passed from server to server, each server inserts one or more lines at the top of the header, acknowledging that the message passed through. In many cases, these lines are pure fiction -- especially the part indicating that the message has passed some sort of anti-spam vetting. I ignore this part, unless I see a pattern. For example, if I notice that a bunch of messages claim to have been vetted by "Breitbart anti spam", I'll certainly have my filter block these messages.

At or near the top of the header is the "Received:" line inserted by your ISP. This is the most reliable line. Since my ISP will perform an inverse domain lookup based on the IP address of the last server, I'll inspect this line for "*.ru)" indicating a Russian domain as the immediate source of the message. I don't do business in, nor do I have any friends or associates in Russia. For some reason "*.br)" is another hot domain.

Spammer wannabe's who want to start their own spamming business will purchase a program, a list, and some time on a botnet. In many cases I believe that these individuals are also victims, lured by the promise of large, quick profits. In any case, the program that they purchase might leave tracks in the header. If you can identify a program based on tracks in the header, search for these.

As I mentioned previously, my filter has improved over time and only a few spams per week will slip through. I keep all of the spam and flip through it every week or two, checking for false positives, because one of my filter elements is very aggressive and some legitimate businesses will use a certain construct that I filter for.

There are bright spots. Microsoft is an active player in the spam wars. A few years ago, after a lengthy period of research and cooperation from a long list of global players, a major bot network was taken down and global spam dropped by about 70 percent in the following hours. It is very difficult to break up these networks because they are actually a distributed network of victim granny computers, each following instructions delivered by another granny computer, the "handler". And, there is no obvious, single point of failure because each granny computer has a list of alternate handlers. With some luck, if you climb the tree of handlers (scattered across the globe), you might eventually discover the primary individual and be able to knock on a door. But this snake can easily regenerate a new head -- unless one breaks up the distribution of handler addresses.