Spam in our Production ServiceNow instance.

[joedumond]

Over the course of the past month, I have seen an increase in the amount of spam received in our Production ServiceNow instance.

Before it was occurring about 5 times per week. Now we receive approximately 20 spam messages per week.

Is there any sort of spam filtering that occurs in the Production instance?

[jasdwr1]

Hi Joe,

We have the same problem with our development instance.   I had opened a ticket with HI and this was the response I received.

By default, Service-now does not filter out emails in our email servers, as each company has their own email requirements and we would not be able to create a specific enough set of rules for this.

Customers can add SPAM protection at the ServiceNow application level. We recommend the following two solutions:

1) Email Filters
Email filters enable an administrator to configure specific email filtering preferences by using a condition builder or a condition script.
SPAM Assassin: Moves email identified as spam to the Junk folder.
http://wiki.servicenow.com/index.php?title=Email_Filters

2) Adding conditions to your inbound email actions to prevent processing.
Administrators can prevent users from untrusted domains from triggering inbound actions. For example, you can prevent email from users outside your company domain from creating incidents.
http://wiki.servicenow.com/index.php?title=Inbound_Email_Actions#Preventing_Untrusted_Users_from_Tri...

If you want to enable SPAM protection before the ServiceNow application level please read below.

The wiki page for Configuring Email discusses spam filtering.
http://wiki.servicenow.com/index.php?title=Configuring_Email

To see how customers can add a spam filter while still using our hosted servers see: Standard Email Configuration Using Your Own Address or Domain. The diagram shows where we would expect customers to implement a spam filter for mail before reaching our mail servers.
http://wiki.servicenow.com/index.php?title=Configuring_Email#Standard_Email_Configuration_Using_Your...

Also, the Next Steps section mentions, "Implement a spam filter to restrict unwanted messages sent to your custom email addresses."
http://wiki.servicenow.com/index.php?title=Configuring_Email#Next_Steps

I understand spam emails can be a problem, but by using 1 or more of the suggestions above you should be able to minimize their impact.

[joedumond]

Thank you for the response.
I will give these a look.

Mail filtering and conditions will be beneficial in other ways as well, so thank you!

[bplatt_uk]

In our instance we noticed that the majority of spam was addressed directly to instance@service-now.com, and judging from the CCs it seemed that we were receiving these due to dictionary attacks on valid addresses in the @service-now.com domain.

Our published email address for our instance - that is used consistently by our users - is helpdesk@companyname.com. We forward those messages to our instance with the result that the instance@service-now.com address never appears in the To or CC headers of legitimate emails.

As a consequence a relatively simple modification to the Create Incident inbound email action blocked almost all the spam we were receiving, with the exception of a small amount that is addressed to our helpdesk address.

The following code did the trick:

var skipmsg = false;

if (email.direct.indexOf('@service-now.com') > -1 || email.origemail.indexOf('@service-now.com') > -1 ) {

  skipmsg = true;

}

if (!skipmsg) {

// original content of inbound action

}

[Dub Myers]

This is an older thread, but for anyone who happens upon it:

The ServiceNow email infrastructure performs spam scoring on incoming email.   Email is scored as spam and/or whether an attachment contains a virus.  

This is only available for instances using the ServiceNow email infrastructure. If you use your own email server, you must implement your own spam scoring.

ServiceNow does not prevent email from being delivered to your instance.   You control what happens to these emails by using Email Filters to check for the spam scoring headers, and causing the instance to ignore the email.

See Email Filters - ServiceNow Wiki for more information.