Using Gmail as a Spam Filter

http://mboffin.com/post.aspx?id=1636

I recently got my Gmail account up and running, but I wasn’t finding a whole lot of use for it since I have a primary account on MBoffin.com that I use for everything. Just for kicks, I decided to have all my MBoffin.com e-mail (spam and all) forwarded to my Gmail account to see how well it would handle my e-mail habits and workflows, and to see how well it would handle the spam.

Gmail did surprisingly well on all fronts. Much has been written in other circles about the nice and not so nice parts of Gmail’s user interface, so I won’t get into that discussion here.

After a couple of days using Gmail as my primary e-mail account, I started missing my MBoffin.com account. I like my MBoffin.com e-mail address and I’m not quite ready to leave it behind. But what to do with this nice new Gmail account? Then it hit me….

Could Gmail be used as a spam filter for my MBoffin.com e-mail account? The answer is yes, it can. And here’s how I figured it out.

Basic Procedure

Gmail allows you to forward incoming messages to any other e-mail address. Go to the Settings page and then to the Forwarding and POP tab. In the Forwarding option, set Gmail to forward all incoming mail to your regular e-mail account, and keep a copy in Gmail’s inbox.

(In this explanation, I will assume your regular e-mail address is user@domain.com and your Gmail address is user@gmail.com, and I apologize to Mr. User over at Domain.com and Mr. User over at Gmail if they get any extra mail from people following the steps in this article too literally.)

Once that forwarding rule is set on Gmail, all incoming mail to user@gmail.com will get spam filtered and anything left over will be forwarded to user@domain.com, with a copy left at Gmail. But that doesn’t help you much yet, because people are still sending spam directly to your user@domain.com account.

Now, over at your user@domain.com’s mail server, create a server-side filter to check the headers of any incoming e-mail. Have it forward to your Gmail account if it does not find the following in the header:

X-Forwarded-For: user@gmail.com user@domain.com

In English, the filter would be written: “Any mail that does not contain ‘X-Forwarded-For: user@gmail.com user@domain.com’ in the mail header should be forwarded to user@gmail.com”.

Once this server-side filter is in place, only mail on its way back from user@gmail.com (already filtered for spam) will be passed to your user@domain.com account’s inbox. Everything else will be forwarded on to user@gmail.com to be filtered and forwarded back.

Another Advantage: Backup

Since Gmail is keeping a copy of all the mail it’s forwarding on, you now have an online backup of all your e-mails. If you were to somehow lose all the e-mails stored on your hard drive, you wouldn’t have to worry, as they would all be safely backed up over at Gmail, already spam filtered and everything. This means you can keep your local e-mail client clean and tidy, deleting e-mails as you see fit without worry that they are being deleted forever. They’re all backed up on Gmail the instant you receive them.

Will Spammers Now Add Headers to Prevent Being Forwarded to Gmail?

Sure, they could easily add the required header and trick your user@domain.com account into accepting spam, thinking it had already been spam filtered by Gmail. But here’s the kicker: They need to know your Gmail account address too.

Final Thoughts

Keep in mind that I only just figured this out tonight. I ran some tests and confirmed that it works, but that’s as far as it has gone. This hasn’t been tested over weeks and weeks, so if it continues to work well in the long run, great. Otherwise, I’m sure someone else will come up with a way to improve this.

While doing the testing, actual spam was being sent to my account (I get hundreds a day), and none of it made it through. It was all trapped at Gmail.