Invisible Inbox™ User Manual
Thank you for selecting Invisible Inbox as your SPAM guard. You have selected the finest SPAM protector that money can buy, you should be proud that you choose so well. We develop based on customer feedback, so please let us know what you think about our product and what additions or changes you’d like to see. Your input is very important to us.

1.	What is SPAM?
2.	Simple for Beginners, Powerful for Experts
3.	Initial Setup
4.	Importing Address from Your Address Book
5.	Setting up Auto Approve Keywords
6.	How Invisible Inbox avoids the pitfalls of Challenge/Response (C/R)
What is SPAM?
The definition of SPAM varies, but we define it as:
"Any email from anyone who does not properly identify themselves."
When someone you know emails you, that's not SPAM and in every case they will properly identify themselves by having a return address that works and accurately reflects the account that they sent the email from. When a SPAMMER sends you an email, they mask their identity, don't offer working unsubscribe and play tricks with the text of the email and the subject line. These people are the scourge of the earth and we are going to work hard to SHUT THESE PEOPLE DOWN!!!
We can't find the SPAMMERS but we can make it impossible for them to benefit from sending you SPAM! We want to give you back control of your Inbox! With SPAM running rampant, we are almost to the point where the most widely used feature of the Internet, namely email, is becoming something we dread rather than a tool we user to better our lives. We are here to fix this problem and clean up this terrible plague that is upon us. WE HATE SPAM!!!
So what about legitimate marketers? Are they SPAMMERS? We don't think so. If they are willing to identify themselves and include a valid method for you to unsubscribe, then we see them as a benefit to the American way, to capitalism itself and know that they work to help build our economy and better all our lives. 
But if once legitimate email marketers cross the line and start acting as SPAMMERS, we say OFF WITH THEIR HEADS! Invisible Inbox allows proper marketing via email, but it requires that the sender validate themselves as proof of their intention to follow the rules. This also gives a path for prosecution if they don't. No SPAM regulations will work unless we are dealing with people we can identify!
"If they won't prove they are legit, then we won't accept their email!"
SPAM is that email you receive with tricky unsubscribe methods that don't work. Unsubscribe from the wrong email and all you do is tell the SPAMMER that a warm body exits at this address and that they should turn up the volume of SPAM they send. 
A legitimate marketer will honor your unsubscribe! But how do you know when it is safe to unsubscribe? Well, it's tough, but the best test, and the one we use, is to know who you are dealing with. Make sure they are willing to be identified, so that if they don't honor your unsubscribe, you can take legal action against them!

Experts will find this manual extremely redundant and boring. I go into great detail to assure that new users get started and understand the product. Most features of Invisible Inbox will be completely intuitive for expert users.
Simple for Beginners, Powerful for Experts
Remember as you work with Invisible Inbox that it is designed for a wide range of users. If you don’t need a feature, then just ignore it, it’s there for someone else, or for you as your needs change. Don’t get all caught up trying to learn every feature of the program the first day. Wait, as you have needs, you will find the solutions built in and you can learn the feature at that time.

Most users can do the Initial Setup and then forget about Invisible Inbox. From that point forward it will simply take care of every need they have with no manual intervention. We find that when you need something extra, you will know it and you can investigate the features needed to resolve your problem at that time.
Initial Setup
We are going to assume that you have downloaded the program and unzipped the file and that you have run the install program “Setup.exe” that was included in the zip file. Running the setup is such a standard operation that I’m going to assume that you got that far without challenge and that you are now running Invisible Inbox for the first time. 

When you run Invisible Inbox for the first time, you are asked to set up the “Primary Server Information” section of the “Configure Accounts” dialog. If you are not an email expert, some of the questions may seem difficult, but I’m going to make it very easy and tell you exactly where to find the answers in Outlook Express. Other email programs will use very similar methods. I am going to assume that if you are running a email program other than Outlook Express, that you have access to a Systems Administrator or are yourself a tiny bit email savvy. No matter the case, if you read how to do it in Outlook Express, it’s my bet that you can apply that information to your email program.

The first thing you are asked to enter is the name of your SMTP server. An SMTP server is used to send email. SMTP stands for Simple Mail Transfer Protocol. It’s a very old system that is well establish and is the primary method that is used to send email on the Internet.

In Outlook Express, use the menu options “Tools->Accounts” to open the “Internet Accounts” dialog. Most people will have only a single account, but for those that have more than one, you need to decide which account is the one that you consider your primary account and will most likely keep for the longest period. When you register Invisible Inbox, the registration is locked to the account you are about to select, so choose wisely so that you don’t have to re-register in the future.

Click on the primary account in the list and click the “Properties” button. This will open a dialog with several tabs. Find the “Servers” tab and click it. Now make sure the top box, the one next to “My incoming mail server is a”, says “POP3”. If it does not, then this account does not use the right type of server to allow it to be protected by Invisible Inbox and you either can not use Invisible Inbox or you need to select another account that does use POP3.

If you are using a POP3 account, then the rest is very simple and we will have you up and running in just a few minutes. Note the 3rd box down which says “Outgoing mail (SMTP)” next to it contains the name of your SMTP server. This is the information that is being asked for by Invisible Inbox. Copy and paste the SMTP server name over to Invisible Inbox being careful not to change it within Outlook Express. Don’t close the accounts dialog in Outlook Express as we still need it open for the following steps.

The second piece of information that Invisible Inbox will ask for is your “Primary Email Address”. Enter your “Primary Email Address” using the information found on “General” tab of the “Internet Accounts” dialog in Outlook Express. You will find it in the “User Information” section next to “E-mail Address”. Copy and paste this information to Invisible Inbox and be sure not to change it within Outlook Express.

Now that you have the first two fields filled in Invisible Inbox, you need to test the connection. Click the “TEST” button to the right of the “Primary Email Address” field on the “Configure Accounts” dialog within Invisible Inbox. If the test fails, check the data and correct any errors. If no errors can be found, then you can not use Invisible Inbox. For most people the test will pass and the fields will turn green and the button will turn green and read “Verified – Click to Edit”. This is a sign that the account was approved for use with Invisible Inbox.

You will now be asked to enter your “Incoming mail (POP3)” server name. Back in Outlook express, you can find this information by once again selecting the “Servers” tab. The information will be found in the second box down, the one that says “Incoming mail (POP3):” next to it. Copy and paste this information to Invisible Inbox.

You need to enter one last bit of information to complete the setup of Invisible Inbox. You need to enter your “Account Name”. This information can be found on the “Severs” tab in Outlook Express in the “Incoming Mail Server” section next to the words “Account name:”. Copy and paste this information into Invisible Inbox being careful not to change the information in Outlook Express.

Now that you have the second two fields filled in Invisible Inbox, click the “TEST” button just the right of the “Account Name” field in the “Primary Server Information” section of the “Configure Accounts” dialog just below the green button you used to test the first two entries.

If the communications with your server were successful, the button will turn yellow and will read “Verifying – Click to Edit”. If the test fails, correct the information by double checking your entries and try again. If you just can’t get the test to succeed, then you can uninstall Invisible Inbox as it will not work for you.

Once the button is yellow, you need to update the “Incoming mail (POP3)” server name entry in Outlook Express to “LocalHost”. What this does is tell Outlook express that the POP3 host it needs to talk to is no longer the one at your ISP, but the one on your local computer. “LocalHost” just means, “Look on my local computer for this host”. You must now click the Send/Receive button at least one time.

This sets up a chain. Outlook Express looks at Invisible Inbox and Invisible Inbox in turn looks at the POP3 server at your ISP. This is what creates the Invisible Inbox that sits between your email program and the POP3 server at your ISP protecting you from SPAM.

Assuming the test was successful, the button will remain yellow until two emails can be sent by Invisible Inbox through your SMTP server and are received by Invisible Inbox from your POP3 server. You may need to wait several minutes an in some rare instances even longer depending on how busy your ISP is and how busy our email auto-responder is.

Once the final email returns from our auto-responder, your account will be verified. At this point, you can be sure that all the settings are correct and the “Register” button will enable. You can not register Invisible Inbox until these settings are all correct. Once registered, you cannot change these settings. If you do, your registration will become invalid and you will need to register again.

Once the “Long” confirm email from our auto-responder is received, the button will turn green and read “Verified – Click to Edit”. Once this happens, you are protected and there is an Invisible Inbox between you and the POP3 server at your ISP where SPAM just withers and dies!
Importing Address from Your Address Book
The key to a successful import is a successful export. What you need to do is first create a comma delimited file that contains the names and email address of everyone in your address book. I’ll use Outlook Express for this example, but you will find the procedure is similar in every email package that offers the ability to create a CSV file as an export option.

In Outlook Express, use the “File->Export->Address Book” menu option to open a dialog that allows you to select the type of export file to be used. Select the “Text File (Comma Separated Values)” option and click “Export”. 

This will open a dialog that requests that you select a file and a location for that file to hold the exported data. I recommend that you store the exported data in the Invisible Inbox program folder which is by default “C:\Program Files\InvisibleInbox”. Name the file “AddressBook.csv”. Any location and any filename will work, but these are the recommended settings. Once you have done this, click “Next”.

You will now have a dialog where you can pick which data elements should be exported. We only want the persons name and email address, so deselect all fields except “Name” and “E-mail Address”. Double check to make sure these two fields are selected and that they are the only two fields selected. You will need to scroll down the list to view all the available fields. When you have only these two fields selected, click the “Finish” button and the file will be created.

You now have a comma delimited text file stored in the CSV format that can be read by Invisible Inbox. Open the “Configure Lists” dialog in Invisible Inbox by clicking on the flying envelope in the system tray near the clock and selecting the “Configure Lists” menu option from the pop-up menu. Just above the “Approved” list you will find a button marked “Approve from Address Book”. Click this button.

A dialog will open that allows you to search, find and select the “AddressBook.csv” file that you just created in Outlook Express. Select the file and click the “Open” button. You will be shown a sample of three lines of data extracted from the file. Review this panel and make sure that the name and email addresses are properly selected. If they are not, then click “No” and recreate the CSV file in Outlook and follow the instructions above carefully. If the data looks correct, then click “Yes” and the entire list will be imported into Invisible Inbox and placed in the “Approved” list.

Now, everyone in your address book can email you from the addresses listed and not need to deal with a Challenge/Response.
Setting up Auto Approve Keywords
Auto approve keywords are very powerful. You can use them to let emails with certain keywords flow through unchallenged. If you have customers who email you, you will want to enter the names of each of your products and services as well as your company name to assure that customers who email you do not need to respond to a challenge email just to ask you a question.

You can also use them to set up “keys” that you can give to people when you give out your email address. If you add a key to the list and then have someone include that key in their email, you can be assured that their email will flow to you unchallenged.

You can also add a key to your email signature or use en existing work in your signature as a key. This was anyone who replies to an email from you will not need to deal will a challenge email. Ideally, very few legitimate emailers will need to deal with a challenge email; those will be reserved for those who email you unsolicited.

You want to be careful not to include keywords that exist in your email address or server names as theses are likely to exist in every email you receive. The entire email is scanned for keywords, not just the body. The full headers and even attachments are scanned.

Keywords can be entered in one of two ways. If you just type a word and click “Add” then the word is used as a “sub-string” search. This means that is the series of characters you enter is found in the email, the email is approved. So if you add the keyword “Ed” to ley your friend Ed send you emails, then every email that has the name “Ed” in it or has a word that has “ed” in it, like “emailed”, “started”, “edit”… in it will be approved as well.

The second way to specify a keyword is using the “Like” format. The “Like” format uses special characters to create what is known as a expression. The expression is used to scan the email and allow much more complex comparisons to be made.

Kind of match		      Pattern  Match	     No match 
Multiple characters		 a*a		aa, aBa, aBBBa	aBC
 *ab*	abc, AABB, Xab	aZb, bac
 ab*		abcdefg, abc	cab, aab 
Special character		 a[*]a	a*a			aaa
Single character		 a?a		aaa, a3a, aBa	aBBBa
Single digit			 a#a		a0a, a1a, a2a	aaa, a10a
Range of characters	      [a-z]	f, p, j	 	2, &
Outside a range	      [!a-z]	9, &, %		b, a
Not a digit			 [!0-9]	A, a, &, ~	0, 1, 9
Combined				 a[!b-m]#	An9, az0, a99	abc, aj0

Remember, you are comparing against the entire email, so if you just enter “ab*” only the rare email where the first header item starts with “ab” will pass through using that keyword. You need to always add a “*” at the start and end of an expression to find it within an email. That then says “Find this pattern anywhere in the email”.

If you check the “Show in Subject” checkbox, then when an email is approved because of a Auto Approve Keyword, the subject will have that added to it so that you know why the email flowed into your inbox.

How Invisible Inbox avoids the pitfalls of Challenge/Response (C/R)
Other Challenge/Response based systems suffer from a wide range of problems that are solved with Invisible Inbox. When done properly, challenge/response offers solid, reliable protection from SPAM. Check competitive systems, and be sure they do everything Invisible Inbox does to protect you and that they do it at a reasonable price!
What is Challenge/Response?
Challenge/Response or C/R is a technology where you can prove the validity of an email by confirming the authenticity of the sender. This is done by sending an email back to the person trying to email you for confirmation that the return address given is accurate.
Everyone who regularly emails me needs to deal with C/R
The Problem:
As soon as you install a C/R system, all your regular email partners will need to deal with a challenge message.
Invisible Inbox Solution:
Invisible Inbox allows you to import your Address Book into the approved senders list so that none of your friends will need to deal with a challenge email when they email you.
Everyone I email needs to deal with C/R if they reply
The Problem:
Everyone who replies to an email that you send needs to deal with C/R.
Invisible Inbox Solution:
Add a keyword to your email signature and add that key to the "Auto Approve" list. Then when they respond, your signature will work as the key to allow their email to be delivered without C/R.
No way to access email until it's approved
The Problem:
While email is waiting to be approved via C/R, it is held outside your email program, usually in a centralized repository and cannot be accessed. You don't know if an important email is waiting and you have no way to approve the emails manually.
Invisible Inbox Solution:
Invisible Inbox holds all of your pending email on your computer in a folder on your hard drive where you can access it any time. Just click any email to read it. The program also has a preview panel where you can review and approve (add to "Approved" list) or reject (add to "Spammer" list) any email prior to the receipt of a response from the sender.
Newsletters and mailing lists can't deal with C/R
The Problem:
While individuals have no problem with C/R, it simply doesn't fit when it comes to mailing lists and newsletters.
Invisible Inbox Solution:
You can manually add any email account or domain to the "Approved" list using expressions (*@someacct.com, *.mx??.* or %MAJORDOMO%) for a very powerful way to pre-qualify any account to be delivered without C/R. If you are familiar with the standard contents of the newsletter or mailing list message you can also add a key that consistently exists in the email to the "Auto Approved" list. You could also wait until the first message arrives and manually approve the message. Any of these methods will approve all future newsletters or mailing list messages from that source which means once the messages are flowing, you can remove the rule to be sure SPAMMERS cannot take advantage of the hole.
Spoofed Response Messages
The Problem:
A SPAMMER sends a fake response without ever receiving a challenge just to get approved and open the flood gates, allowing them to send all the messages they want without being blocked. 
Invisible Inbox Solution:
When we send a challenge email, it includes a special ID number generated at the time the challenge is sent. Unless the response includes that ID, it isn't accepted. As the ID is nine digits long, it would require the SPAMMER to send ONE BILLION fake response emails just to open one email address to allow delivery. Not something that is going to happen!
First time trusted mailers need to deal with C/R
The Problem:
All new emailers will need to be approved through the C/R system before their email can be delivered.
Invisible Inbox Solution:
You can specify as many different "Keys" which when included in an email automatically cause the sender to be approved. Just tell your friends to include one of your keys and their email account will be marked approved immediately upon arrival of their first email. They only need the key one time, after that they are approved and all email will flow in without challenge.
You can change your keys as often as you like and have as many different keys as you like to assure that SPAMMERS never get hold of any key that might let them in.
Legitimate customers need to deal with C/R
The Problem:
Customers with sales or support questions are put off by the need to respond to a challenge email before their questions can be answered.
Invisible Inbox Solution:
Just put the names of each of your products or services in the "Auto Approve" list and emails from customers will be delivered to you without C/R. In fact, the customers account will be remembered and future email from that customer will be delivered even if they do not mention your product or service. You can add as many keywords as needed to assure that customers never deal with C/R.
C/R - C/R deadlock
The Problem:
User A sends user B a valid email. User A sends a challenge to use B. User B then sends a challenge to user A who then in turn sends another challenge to user B and the cycle continues forever. This is commonly seen with "vacation" auto-responder systems.
Invisible Inbox Solution:
Each email address can only be sent a single challenge message. This stops the deadlock before it can start. One of the parties will need to manually accept the challenge email if the two users use different C/R systems. But if both users use Invisible Inbox, then the C/R process is handled automatically. When a challenge is received, it is automatically responded to. So you will never need to respond to a challenge email from another user of Invisible Inbox. A great reason to get all your friends to standardize on using this one SPAM fighting solution.
Privacy Issues
The Problem:
A centralized C/R center scans the content of all the email sent to and from your account to collect personal information to be used in who knows what ways. The centralized system sees and monitors all your email.
Invisible Inbox Solution:
Invisible Inbox is distributed. Your email is scanned only on your machine and any data about each sender is stored only on your machine. We do a single C/R check with you as you set up the program for the first time and again when you register to assure that you are who you say you are. We collect no data from you other than the data included in the challenge email. No passwords, not even your name, are sent in the challenge emails. 
The initial challenge lets us assure that your end of the transaction is legitimate. This way we know that no SPAMMER is setting up fake accounts and that the program is not being used improperly. 
Your computer then sends all challenges to those who email you, and thus only requires that your computer handles sending challenges and handling the responses from the other side of each conversation. We have no clue as to who emails you or who you email. Your privacy is secure with Invisible Inbox!
Potential integration into spam email harvest systems.
The Problem:
A SPAMMER gets back a challenge email proving that the email address is a live account and thus increasing the value of the address.
Invisible Inbox Solution:
While the challenge email does prove the existence of a real account, it also effectively defines the account as inaccessible to unsolicited marketing emails. This drops the value of the account to zero for SPAMMERS but allows valid marketers, willing to be identified to respond to the challenge and then deliver marketing emails. 
This assures that every marketing email received comes from a trusted source and that the normal unsubscribe process or manually listing the source as a SPAMMER will work to stop those messages from arriving. No one willing to be identified can be called a SPAMMER, even if they send unsolicited emails. If they do not use subject lines that accurately represent the content or they do not honor unsubscribe, then the fact that they are identified means that legal action can be taken against the sender.
C/R messages and users blacklisted or spam filtered
The Problem:
The challenge email causes problems and complaints and as such becomes blocked by popular spam filters or added to personal blacklists. 
Invisible Inbox Solution:
We took special care in crafting our challenge message to make it clear, easy to read and made sure it did not include any of the common "tells" that mark an email as SPAM so that it is sure to travel through any SPAM filter with ease. Unlike centralized C/R systems, Invisible Inbox originates all challenges from your computer, and as such the only personal black lists that would block the challenge would be those that already had YOU listed as a SPAMMER. I don't think that will happen, do you? 
Bounced Challenge Messages
The Problem:
A SPAMMER sends an email using a non-existent email address. A challenge email is sent to that address only to be bounced back to the sender as undeliverable.
Invisible Inbox Solution:
We check the validity of every email address before we send a challenge. We fist check the DNS MX record (Tells which mail server(s) handle that address) to make sure it's legitimate. We then do a full SMTP session check using both the VRFY (verify) command, and a true mail handshake (HELO, MAIL FROM, RCPT TO) which assures that there is a legal recipient for the message. (Basically, it checks that the email server knows the address before it tries to send a challenge email to that server)
Potential "Joe-job" denial of service.
The Problem:
Spammer spoofs a legitimate sending address (this is already commonplace). C/R systems then send out a challenge to this address. With only 1% penetration of C/R, the victim of the C/R SPAM attack is deluged with 100,000 challenge emails.
Invisible Inbox Solution:
Invisible Inbox checks the source server of any new sender to confirm that the source of the email is the same as the email address listed as the sender. This means to spoof a user, the SPAMMER would not only need to spoof the address, but use the same SMTP server as the real user, making tracking of the spoofer much easier and far to dangerous for the SPAMMER to attempt. 
Emails from the wrong server are treated just as a message where a challenge message is sent, but none is ever delivered. This way the user can manually approve the email or manually market it as SPAM, or they can just allow time to pass and the system will automatically mark the email as SPAM after a given period.