2011-05-07
Email has two faces today
I've recently realized something about email. In the modern world, email has become at least two applications in one. Email has become both an internal communication system and an external communication system, where 'internal' and 'external' are not necessarily based on organizational boundaries but are also a matter of a trusted circle of regular correspondents.
(I'd argue that this split exists even if your job involves dealing with the outside world. Email from your boss is still at least somewhat different from email from customers and would-be customers.)
This split matters because the two have very different reliability requirements. The internal system needs its messages to get through all of the time; to put it one way, it's not acceptable to miss an email from your boss because your spam filter ate it. At the same time, this doesn't mean that the external communication system should have only minimal spam filtering. If it needs to have minimal filtering to make sure you never miss email from your boss, that's a bug that needs fixing.
(The two different systems also have quite different spam levels. In most environments the internal system has no spam at all, while for typical people the external system is basically all spam because they almost never get email from real people who are outside their regular circle.)
I suspect that many email systems already embody some form of this realization. Certainly ours treats email from inside machines somewhat differently than it does email from outside machines, although at the time that I configured it I was only thinking 'let's avoid a bad explosion if any of our machines ever get listed on a DNS blocklist'. (Answering the question of why it would be bad to block an internal machine in that situation leads to my realization.)
There are obvious corollaries for spam filtering techniques, although the more I think about the issue the harder it is to do anything simple. Perhaps the easiest thing to do is to relax spam filtering rules based on the extent that you're truly sure something is internal communication, but that probably needs a bunch of site-specific and person-specific rules.
(The general challenge is being able to reliably tell internal communication apart from external communication in the face of spammers trying to fake the system and people using outside email systems like GMail. How do you tell apart a spammer using GMail from one of your users sending from their GMail address?)