Nonetheless, many CIOs ask their IT department to keep the e-mail boxes clear of anything offensive. Yet, according to Scott Kitterman of ControlledMail.com, "I want zero spam and I want to never ever miss a legitimate message" isn’t feasible. Kitterman explains, "This is a risk management practice, and you need to decide where you want to put your risk. Would you rather risk getting spam with lower risk of losing/delaying messages you actually wanted to get, or would you rather risk losing/delaying legitimate messages with lower risk of spam? You can’t have both, no matter how loudly you scream."

Tom Limoncelli, author of The Practice of System and Network Administration (Addison-Wesley) and Time Management for System Administrators (O’Reilly), stresses that because fighting spam is not an exact science, there always will be false positives and false negatives. The IT department has to cope with this. Limoncelli had a CTO complain when he missed an important message because it was caught in the spam filter. Says Limoncelli, "This system sent him e-mail once a day with a list of his messages that had been blocked; clicking on any of them ’releases’ it from the quarantine. … He wanted a report for every message that was blocked. At least that was his initial request; he then realized that he had asked for an e-mail to warn him of every e-mail!"

2. There’s No Silver Bullet.
In many areas of IT, the long-term solution is a simple one: Adopt the single right methodology, hire the right consultant, buy the most appropriate product. But your IT staff wants you to understand that spam isn’t a problem that can be solved with a single technology, a single product or any one answer.

Vendors of spam-fighting hardware and software will tell you different—but they’re wrong. Bill Cole, senior technical specialist at T-Systems North America, has been fighting spam for more than a decade. Everyone involved in that fight, he says, dreams of the "Final Ultimate Solution to the Spam Problem." But, he cautions, people who yearn for a single answer may fall prey to a vendor’s magical "answer," but "in a year or so, the magic is gone and the spammers have adapted." Then, he notes, "managers get upset, a new ’solution’ gets deployed, and the cycle goes around again."

Brad Knowles, a consultant, author, and former senior Internet mail systems administrator for AOL, adds, "In almost all cases, the so-called ’simple’ answers are the ones that don’t work. In fact, they’re almost always the ones that make the problem much worse than it already was. Since we’ve been fighting spam for over a decade, pretty much all the good simple ideas have already been thought of and implemented, and the spammers have already worked around them."