Copyright: Copyright 2003 Ipswitch, Inc.
Citation: 2003 Ipswitch, Inc.


What is the Anti-Spam Feature?
Anti-Spam Overview

The IMail Server anti-spam feature identifies spam and prevents it from clogging up your inbox. All mail messages are passed through several layers of filters and tests to assure that maximum spam detection is achieved.

What You Can Do

•	Create a white list, which contains e-mail addresses and domains for which you do not want to perform content filtering.

•	Use connection filtering to compare e-mail messages against configurable DNS black lists to see if they are from IP addresses that are known to send spam.

•	Use phrase filtering to configure a phrase list that searches for specific spam phrases within the body of e-mail messages.

•	Enable statistical filtering to analyze on each incoming e-mail to determine whether the message is spam.

•	Enable connection verification checks, which verify the "Mail FROM" address, HELO/EHLO domain information, and perform a reverse DNS lookup on incoming e-mail messages.

•	Enter Trusted IP Addresses and subnet masks for which no spam filtering is done.

•	Configure delivery rules to trap messages based on spam X-Headers that are inserted when an e-mail fails a spam test.

Configurable for Each Host

DNS black lists, which are configured and enabled at the server level, compare the sender information from incoming messages, against spam databases to identify spam.  DNS black lists are then used at the host level, where host administrators can choose which ones to enable for the host.  All other anti-spam options are completely controlled by each host, assuming each host has a valid IP address. Thus, each host can use different DNS black lists, different white lists, different phrase lists and define their own statistical filtering configurations.

Spam Actions

If a message is identified as spam, you can either delete it, send it to an e-mail address, or insert an X-header in the message to identify which spam test it failed. You can also create delivery rules to search for the spam X-Headers and process the message accordingly.

Accessing the Anti-Spam Features

The Anti-Spam options can be accessed from two places: the server level and host level.

Click here to get started with the Configuration Overview


Logging

IMail Server logs all anti-spam events, such as error messages, to a separate log file. These events are stored in the log file that is selected on the Log To list box on the anti-spam Logging tab. The log files also contain any text that is returned by a black list if a message’s IP address is listed.  Other anti-spam events that are in the log file include:

•	Enabling/disabling phrase filtering or content filtering.

•	Initialization of phrase filtering and content filtering for each message.

•	Verification checks performed on a message and the results.

•	Connections to DNS black lists and the results of the connection.

File Format

The file format for anti-spam log lines is similar to that of the IMail Server logs, except that anti-spam log messages also contain an anti-spam message ID. The generic format of a log file entry is:

Date  - Time - Thread or Process ID –Anti-Spam Message ID - Host name – Entry Type - Message

Example

Anti-Spam Message ID

When the anti-spam engine processes a message, it assigns it a message ID. This message ID allows you to identify all log entries for specific messages. For example, if you want to identify all log entries for the above example, you would look for every entry that contains the anti-spam message ID of (00001316).

Related Topics:

Anti-Spam Logging tab

Example Log File

Anti-Spam Log Messages


IMail Anti-Spam Processing Order
Anti-Spam Processing Order

The following steps indicate the order in which each anti-spam feature is performed. For information on how these anti-spam features integrate into IMail Server mail processing see IMail Server Processing Order.

1	Trusted IP Addresses. The IP address of an incoming message is compared against the trusted IP address list to see if it matches. If it does match, the message is delivered. If the IP address does not match, the verification checks are performed.

2	Verification checks. Verification checks are performed to verify the "Mail FROM" address, the HELO/EHLO domain, and to perform a reverse DNS lookup. If a message passes all the checks, connection filtering is performed.

3	Connection Filtering. IMail Server initiates connection filtering to compare messages against configured DNS black lists. If a message matches a DNS black list, it is processed according to the spam action settings on the Connection Filtering tab. If the message does not match a black list, content filtering is performed.

4	White List. IMail Server checks to see if the connecting SMTP server’s IP address is listed in the white list. If it is, the message is delivered to its intended recipient. If it is not in the white list, the message is passed on to phrase filtering.

5	Phrase Filtering. If phrase filtering is enabled, the message is checked to see if it contains any phrases that are in the phrase list. If it does, it is processed according to the settings for phrase filtering. If it doesn’t, it is passed on to statistical filtering.

6	Statistical Filtering. If statistical filtering is enabled, the message is compared against the spam and non-spam word counts to determine if it is statistically likely to be spam. If it is determined to be spam, it is processed according to the statistical filtering spam action that is specified in the Content Filtering tab. If the message is not spam, it is delivered to the intended recipient.

Related Topics

IMail Server Processing Order


X Header Explanations

When an e-mail message matches a DNS black list that is contained in the "DNS black list (insert X-Header)" section of the Connection Filtering tab, an X-Header line is inserted into the message header. This X-Header indicates which black list the message matched. X-Headers are also inserted when a message fails one of the verification tests.  Several examples and table of all anti-spam X-Headers are shown below.

X-Header Example 1

X-Header Example 2

Related Topics

Log Lines Overview

Anti-Spam Logging tab

Using IMail Rules to Filter Spam

Log Messages

How Black Lists Work


Using IMail Rules to Filter Spam
Using Delivery Rules to Filter Spam

Delivery rules area powerful for filtering spam, because they offer more options for processing messages than the anti-spam components. Using the anti-spam components, if a message is identified as spam, you can delete it, forward it to an e-mail address or insert an X-Header. By using delivery rules to process the message, you can choose: delete, forward, move to mailbox, copy or bounce. Delivery rules can be set up at the host and user levels.

If a message matches any of the black lists, or fails a verification check, an X-Header is inserted into the message header.  In addition, phrase filtering and statistical filtering can also be configured to insert X-Headers. If you want to catch such a message, you can set up a rule to search for one of the X-Headers. If a message is trapped by a rule, it is immediately processed according to the action specified in the rule.

Tip: You may want to select the Insert X-Header option and set up a mailbox specifically for spam, so that you can evaluate the messages that are trapped to ensure that no legitimate mail gets caught by mistake.

Example 1: Bouncing spam messages

Example 2: Filtering messages listed in a black list for a specific reason

Example 3: Sending spam to a specific folder in a user’s account

Example 4: Receiving Mailing Lists and Newsletters that are identified as spam

Related Topics:

Delivery Rules Overview

Rules Dialog

Anti-Spam X-Headers


Types of Filters

Phrase Filtering

Phrase filtering searches for common spam phrases within the body of an e-mail message and identifies the message as spam. Phrase filtering can be enabled/disabled per host, and works independently of statistical filtering. For more information see Phrase Filtering.

Statistical Filtering

Statistical filtering examines each word in the body of an e-mail and evaluates whether the word is a statistical indicator of spam. The entire message is then evaluated based on the combined word counts to determine whether it is likely to be spam.  You can create a host specific exclude list, specify what action to take when a message is identified as spam, and specify whether to use the primary host’s word counts or create new ones. For more information see Statistical Filtering.

Delivery Rules

You can use host and user delivery rules to process messages based on the spam X-Headers which are inserted when a message fails a spam test. For more information see Using Delivery Rules to Filter Mail.


White List

Getting to the White List dialog box

Addresses and domains in the white list, are ones that you will always accept mail from. Messages from these addresses and domains are processed immediately upon receipt, without going through statistical or phrase filtering.  This dialog box displays the white list entries for the current host, which are stored in the white-list.txt file, located in the host’s directory.

Adding an Entry to the White List

1	Click Add to open the Add a domain or email Address dialog box.

2	Enter either a domain or an e-mail address into the text box.

3	Click OK to add the entry to the white list and to the list box on the White List dialog box.

4	To save the new white list, click OK on the White List dialog box.

Editing an Entry in the White List

1	In the White List dialog box, select the entry you want to edit.

2	Click Edit to open the Edit Domain or Edit E-Mail Address dialog box.

3	Make any desired changes, and click OK.

4	To save the new white list, click OK on the White List dialog box.

Removing an Entry in the White List

1	In the list box, select the entry that you want to delete.

2	Click Remove.

3	To save the changes to the white list, click OK on the White List tab.

Related Topics

Trusted IP Addresses


spam database

A spam database (also known as a black list) is a database of IP addresses that are known to send spam, or that have an open mail relay.


Spam-definition
Spam (definition)

Spam is any e-mail that is not wanted or requested by the recipient. Unsolicited bulk e-mail is an example of spam.


FAQ

Will the anti-spam features slow down mail processing?

Under normal circumstances, the anti-spam features will not impact mail delivery. However, the verification options may slow down the server, as they are resource intensive.

How does the anti-spam engine interact with IMail Anti-Virus?

IMail Anti-Virus complements the anti-spam features of IMail Server. Connection filtering and verification for anti-spam are completed first, followed by the Anti-Virus scan. Then, the other anti-spam processes are initiated, beginning with content filtering. See also IMail Processing Order

What can I do if legitimate mail is identified as spam?

You can place the e-mail address or domain name, from which the message was sent, in the white list to always allow messages from them to be delivered.

If a small number of messages are being misidentified, you can use the antispamseeder.exe utility to add the messages to the antispam-table.txt file. This will increase the likelihood that similar messages will be correctly identified in the future.

If a large number of legitimate mail is being identified as spam, you will need to modify the Advanced Statistical Filtering settings. Begin by increasing the Spam email probability benchmark option to 95%. If that has no effect, decrease the Probability a new word is spam option to 10%. See Also Advanced Statistical Filtering.

How do I know if the black lists are accurate?

The black lists used are not maintained by Ipswitch, therefore we cannot verify their accuracy. Some black lists are updated more frequently than others, and contain more accurate information. You should be aware of this especially if you decide to configure your own black lists. For your convenience, IMail Server allows you to identify trusted black lists. These are black lists that you have tried and found to be accurate.

Where does Spam go?

By default, messages that are identified as spam are forwarded to a mailbox called "bulk" within the root account. If you have changed the "Forward To" setting, located on the Content Filtering tab, then spam goes to the address that is entered in this field.

How do I access the Anti-Spam features?

Only system and host administrators can access the anti-spam tabs. System administrators have access to the server level DNS black lists and logging tabs. Host administrators have access to the host level DNS black lists, connection filtering, content filtering, and Trusted IP Addresses tabs.

The anti-spam tabs can be accessed from two places: the server level and host level. To access the server DNS black list configuration dialogs, expand the localhost in the left panel, and select the Antispam folder. The server level anti-spam options appear on the DNS Black Lists and Logging tabs located in the right panel.

To access host level settings, expand the localhost, in the left panel, and select a host (with an IP address). Under the host, select the Antispam folder. The host level anti-spam options are displayed on the Connection Filtering, Content Filtering and Trusted IP Addresses tabs in the right panel.

You can also access anti-spam settings from Web Messaging by selecting Anti-Spam Administration from Administrative Account Options.

Will the anti-spam features affect mailing list subscriptions?

Most mailing list subscriptions will not be identified as spam. However, to ensure that mailing list messages are not identified as spam, place the domain name from which the mailing list is sent in the White list. See Creating a White List.

If you do not trust the domain, you can create a host rule to send the message to a folder for the user (i.e. spam), and the user can create a user rule that puts the message in their Inbox. See also Using Delivery Rules to Filter Spam.

Do the anti-spam features work with Web Messaging?

Yes. IMail Server processes mail from IMail Web Messaging in the same way it processes all other mail. In fact, system and host administrators can even configure anti-spam settings directly from Web Messaging.

Do I need to use the Antispamseeder.exe utility to alter my word counts?

The antispam-table.txt file, that ships with the product, is appropriate for most users. However, you may need to alter this file if we have identified words as spam that you do not consider to be spam, or vice versa. For example, the word "mortgage" is identified as spam because in our tests, it occurred 364 times in non-spam, and 7516 times in spam. However, at financial institutions, the word "mortgage" is a non-spam word that occurs frequently. In this case, you need to alter the antispam-table.txt file so that statistical filtering recognizes the word "mortgage" as non-spam.  See also, Customizing a Host's Antispam-table.txt file.

Will the anti-spam features prevent my users from sending spam?

The anti-spam engine automatically filters mail from all users who are not authenticated. If you are concerned about your authenticated users sending spam, you can prevent this by selecting the Content Filtering for Authenticated Users option located on the Content Filtering tab. By doing this, outgoing mail from authenticated users is always evaluated to determine whether it is spam.


Cofiguration Overview
Configuration Overview

The following topics explain the basic tasks you need to complete to configure the anti-spam features of IMail Server.  Once these tasks are complete, your server will be protected from spam.  After you complete the basic setup tasks, you may want to read the Advanced Setup topics to learn about other ways to configure the anti-spam features.

Basic Setup Tasks

To set up the basic anti-spam configuration, complete the following steps:

•	Server Configuration:

Configure DNS Black Lists for the Server

Configure Logging Options

•	Host Configuration:

Configure Connection Filtering

Configure Content Filtering

Create a White List

Enter Trusted IP Addresses


Connection Filtering

Getting to the Connection Filtering tab

This tab allows you to enable/disable the DNS black lists for the current host. No black lists are enabled by default, so each host must enable the black lists immediately after installation. Once a black list is enabled, it is displayed in one of the list boxes on this tab. The black lists that are displayed are dependent upon which black lists are configured for the server. If a black list is not configured for the server, it cannot be used by a host, and will not be displayed on this tab.

DNS black lists can be separated into two categories:

•	DNS Black Lists (insert X-headers) If the IP address of an e-mail matches one of these black lists, an X-header is inserted into the message header to indicate which black list it matched. The message is then passed on to Content Filtering for further examination.

Select Delete Message after X matches, to delete the message immediately if it matches x number of black lists plus verification options. The value entered here must not be greater than the number of black lists plus the number of verification options that are configured. Example

•	Trusted DNS Black lists (immediate deletion) If the IP address of an e-mail matches one of these black lists, it is immediately deleted and no further spam filtering is performed.

Procedures:

Enabling a DNS Black list

Changing a Black List Type

Removing a DNS Black list

Verification Options:

Select any of the following verification tests to perform on incoming e-mail messages. If a message fails any of the checks, an X-Header is inserted into the message.

•	Verify MAIL FROM Address

•	Perform reverse DNS lookup for connecting server

•	Verify HELO/EHLO Domain

Note: These options are resource intensive and may slow down mail processing.

Display Options:

Name.  The display name for the black list that is used in log lines to identify the black list entry. This name does not have to correlate to the actual name of the black list.

Server.  The domain name or IP address of the DNS server to contact for black list queries.

Query Domain. The domain to query in the zone file of the black list. This name usually matches the server domain name. However, sometimes a black list will contain multiple zones to query on the same server. When this happens, the server name and the query domain will be different.

Type. Identifies the type of test that the black list performs:

•	ADDR(address)

•	DNS

•	HELO

•	RHS (right-hand side)

Related Topics:

Configuring a Black List for the Server

Adding a Server Black List Entry

Entering Trusted IP Addresses

Preventing Undesired IP Addresses from Connecting to SMTPD


Phrase Filtering

Phrase Filtering searches for common spam phrases within the body of e-mail messages. If a message contains one of the phrases in the phrase list, it is identified as spam and you can choose to delete it, forward it to an e-mail address, or insert an X-Header into it. The phrases are stored in the phrase-list.txt file, which is located in the IMail top directory. You create this list by adding phrases under Phrase Filtering on the Content Filtering tab.

Related Topics

Configuring Content Filtering

Statistical Filtering


Statistical Filtering

Statistical filtering examines each word in the body of an e-mail message to determine if it is spam. Each word within a message is compared against known spam and non-spam word counts, and assigned a value based on whether the word is likely to be spam. Then, the entire message is assigned a probability based on the assessment of all combined word counts.  If a message is identified as spam, you can choose to delete it, forward it to an e-mail address, or insert an X-Header into it. Words that contain non-alphabetic characters, such as numbers, are treated differently from other words, see Identifying Wildcards in E-mail for more information.

To increase the chances that legitimate messages will not be identified as spam, you can create a host specific exclude list. The exclude list contains words that you do not want to be included in the statistical analysis, because they are just as likely to appear in non-spam messages as they are spam messages. The exclude list is stored in the exclude-list.txt file which is located in the host’s directory.

Advanced Statistical Filtering

The advanced statistical filtering options control the underlying functionality of the statistical filtering component. These options are useful for experienced administrators who want to further refine the anti-spam filtering ability.

Related Topics

Advanced Statistical Filtering

Configuring Content Filtering

Phrase Filtering


DNS Black Lists Overview

IMail Server uses DNS black lists during connection filtering. In order to fully understand how anti-spam and connection filtering work, it is necessary to understand DNS black lists.

What is a DNS Black List?

DNS black lists are databases of known spammers. These databases contain a list of IP addresses  which are known to send spam. They also contain IP addresses that have open mail relays, because a spammer can easily use these systems to send out spam.

How IMail Server Uses DNS Black Lists

Connection filtering compares each message against the configured DNS black lists to see if the IP address of the connecting server is listed.  If the result is positive, the message is either deleted or an X-Header is inserted into the message.

  "Trusted" DNS Black Lists

You can separate DNS black lists into two categories: standard DNS Black Lists, and trusted DNS Black Lists.  A trusted DNS black list is one that you know is updated frequently, and is more likely to be accurate. You may also identify a black list as trusted because you find that for your uses it produces the least number of false positives. If a message matches one of these black lists, it is automatically deleted.

A standard DNS black list is a black list for which you are uncertain about its accuracy. If a message matches one of these lists, an X-Header is inserted into the message, indicating which black list it matched.

Configurable for Each Host

DNS black lists are configurable for the entire server, which enables a system administrator to decide which DNS black lists are available to each host. Each host administrator is then responsible for enabling the configured black list for the host. A host cannot use a black list that is not configured and enabled for the server.


HELO/EHLO Domain Validation
HELO/EHLO Domain Verification

The domain passed during the HELO/EHLO is used to perform a DNS query to verify that the domain specified has an "A" record or an "MX" record. If this test fails, an X-Header is inserted into the message.

Note: The SMTPD service does not accept mail from clients that do not begin the SMTP conversation with "HELO" or "EHLO".

Related Topics

Configuring Connection Filtering


FROM Line Validation
FROM Line Verification

The "From" address of the connecting server is verified for each message to ensure that the user is a valid user on the mail server. If the user or server does not exist, the message is identified as spam.

Related Topics

Configuring Connection Filtering


Reverse DNS Lookup
Reverse DNS Lookup Verification

The IP address of the connecting server is used to perform a reverse DNS lookup, to determine the domain name. If a domain has a valid PTR record, the message is accepted.  If a reverse lookup fails, it means there is no reverse record for that IP address, and the message is marked as spam. An IP address with no PTR record is usually either a dial-up or spoofed, both of which are indicators of spam.  However, it should be noted that a significant number of legitimate mail servers do not have a reverse DNS entry. This may cause legitimate mail to be marked as spam (false positive).

Related Topics
Configuring Connection Filtering


Server Level Black Lists

Getting to the DNS Black Lists tab

All black lists must be configured and enabled at the server level before a host can use them. This allows a system administrator to decide which black lists to allow the hosts to use. Only black lists that are enabled on the DNS Black Lists tab are available for use in host level configurations. The DNS black list entries for the server are stored in the spamblkm.txt file, which is located in the IMail Server top directory.

There are several black lists that are configured and enabled by default. For a list of these black lists, click here.

There are many black lists other than the ones that are pre-configured. To find other black lists, do an Internet search on the term black list.

Related Topics:

Connection Filtering (Host Level DNS Black Lists)


Getting to the Black List tab for the Server
Getting to the DNS Black Lists tab

1	In the left panel, expand the localhost, and select the Antispam folder.

2	In the right panel, select the DNS Black Lists tab.


Getting to the Connection Filtering tab

1	In the left panel, expand the localhost and select a host with an IP address.

2	Under the host, select the Antispam folder.

3	In the right panel, click the Connection Filtering tab.


Add DNS Black List

Getting to the Add DNS Black List dialog box

To configure a new DNS black list for the server, or edit an existing black list enter the following information and click OK.

Name.  Enter a display name for the black list. This can be any name that you want, and does not have to correspond to the actual name of the black list. This name will be used in log lines to identify the black list entry.

Server.  Enter the domain name or IP address of the DNS server to contact for black list queries. By default, this field contains a asterisk ( * ) for all default and new black lists. When an asterisk is entered, the default IMail Server DNS is used for black list queries. The default DNS server relays the DNS query to the DNS server for the black list. Therefore, if you enter an asterisk, you do not need to enter the IP address or domain of the black list.

Query Domain. The domain to query in the zone file. This name usually matches the server domain name. However, sometimes a black list will contain multiple zones to query on the same server. When this happens, the server name and the query domain will be different. The only way to know this is to read the documentation for the black list being used.

Type. The type of lookup that the black list performs.  Select from the following types:

•	ADDR(address)

•	DNS

•	HELO

•	RHS (right-hand side)

Enabled. This setting determines whether hosts can use the black list. When enabled, the black list appears in the Add DNS Black list dialog box for a host. If this option is cleared, the black list is not displayed on the Add DNS Black List dialog box for the host, but will still be displayed at the server level.

TCP/IP First. Some black lists, especially ones that supply txt records, have packets that are too large to transmit via the UDP protocol. These lists disable UDP access and require TCP to query the black list. This option allows the administrator to flag a list as one of these types.


Getting to the "Add Server Black List Entry" dialog box

1	In the left panel, expand the localhost and select the Antispam folder under it.

2	In the right panel, select the DNS Black Lists tab and click Add.


ADDR(address)

This type of black list uses a message's "FROM" address to determine whether the message is spam.


DNS Black list

This type of black list checks the IP address of the connecting SMTP server against spam databases to determine whether the message is spam. If the IP address is listed in one of the black lists databases, the message is identified as spam.


HELO
HELO/EHLO

This type of black list checks the domain supplied in the HELO or EHLO command to determine whether to accept the message. The hostname that is given in the HELO/EHLO command must match the IP address.


RHS (right-hand side)
RHS (right-hand side) Black List

This type of black list checks the information following the @ symbol supplied in the "MAIL FROM" command to determine whether the message is spam.


Enabling Black Lists for the Server
Server Black Lists (DNS Black Lists tab)

Getting to the DNS Black Lists tab

Use this tab to add, edit and delete server black lists. All black lists that are currently configured for the server are displayed here. Server black list information is stored in the spamblkm.txt file which is located in the IMail top directory. Several black lists are configured and enabled by default. For a list of the pre-configured black lists click here.

Note: Only black lists that are configured and enabled on this tab are available for use by a host. Once you enable a black list for the server, you must enable the black list for the host on the Connection Filtering tab.

Procedures:

Adding a DNS Black List for the Server

Editing a DNS Black List for the Server

Removing a DNS Black List for the Server

Enabling/Disabling DNS Black Lists

To enable/disable a DNS black list from this tab, simply select the black list from the list box, and click either Enable or Disable.

A DNS black list must be enabled at the server level in order for it to be available for use by hosts. If a DNS black  list is disabled, it will not be available for use by hosts. If a DNS black list is in use by a host, but is then disabled at the server level, the black list is immediately disabled for the host and removed from the Connection Filtering tab.

Display Options

Name. The display name that is used to identify the blacklist at the server and host levels, and in log files.

Enabled. When a black list is enabled, it appears in the Add DNS Black list dialog box for a host. If this option is cleared, the black list is not available for selection in the Add DNS Black List dialog box for a host.

Server. The domain name or IP address of the DNS server to contact for black list queries.

Query Domain. The domain to query in the zone file. This name usually matches the server domain name.

Type. The type of lookup that the black list performs.

•	ADDR(address)

•	DNS

•	HELO

•	RHS (right-hand side)

TCP First.  Identifies black lists that require the use of TCP to query the black list.

Related Topics:

Host Level Black Lists (Connection Filtering tab)


Add DNS Black List for a Domain
Add DNS Black List for a Host

This dialog box allows you to enable DNS black lists for the host. In order for a black list to appear in this list, it must be configured for the server. If no black lists are displayed, see DNS black lists for information on how to configure DNS black lists for the server.

To Enable a Black List for a Host

1	Select the name of the black list in the list box.

2	Click OK.

3	The new DNS black list now appears on the Connection Filtering tab.

4	To save your changes, click Apply at the top of the right panel.

Note: To make multiple selections, press the Ctrl Key on the keyboard and select the black list names.


Forward To Example
"Forward To" Example

Enter an e-mail address in the form of user@domain.com. If the address is located on the same host, you can omit the domain and simply enter the user ID.

If you want the spam to be sent to a mailbox, place a hyphen between the user and sub-mailbox name, such as root-spam@domain.com. If the account is located on the same host, you can omit the domain and simply enter root-spam.

Notes:

•	If you enter an address with a sub-mailbox that does not exist, the sub-mailbox will only be created if the Sub-Mailbox Creation settings for the host are set to Create. For more information, see Mail Host Properties(General tab) or the IMail User’s Guide.

•	If you have chosen the Forward To option, be aware of the Default Max Mailbox size limit on the General tab of the mail host. If you receive a large quantity of spam, this limit could be exceeded for the mailbox that stores spam. You will need to delete the messages from this mailbox on a regular basis.  You may also want to set up a "Full Mailbox Notify Address" to which an e-mail is sent when a mailbox is almost full.


False Positive-definition
False Positive (definition)

A false positive is when a legitimate e-mail is incorrectly identified as spam.


Enabling Content Filtering
Configuring Content Filtering

Getting to the Content Filtering tab

Note: Modifications to the options on this tab are not saved until you click Apply.

Statistical Filtering

Use this section to configure the Statistical Filtering options. You can create and maintain the host specific exclude list, specify what action to take when spam is identified, and specify whether to use the primary host’s word counts or create new ones. The list box displays the contents of the exclude list.

Procedures:

Adding Words to the Exclude List

Editing Words in the Exclude List

Removing Words from the Exclude List

Options: Set the following options to configure statistical filtering. To configure advanced options, see Advanced Options.

Enable (selected by default). Select this option to enable statistical filtering. If this option is cleared, all other options under statistical filtering are disabled.

Spam Action. Specify one of the following actions to take on a message that is identified as spam:

•	Delete. Immediately deletes the message.

•	Forward to (default). Forwards the message to an e-mail address. You must also enter an e-mail address in the text box to the right of this option. If no address is entered, messages will be sent to the root address and stored in a mailbox called "bulk". Example

•	Insert X-Header. Inserts an X-Header into the message indicating that the message was identified as spam by statistical filtering. See also X-Header Explanations.

Note: For more spam options see Using Delivery Rules to Filter Spam.

Use Primary Anti-Spam Table (enabled by default). Select this option if you want to use the primary host’s antispam-table.txt file, instead of creating a new one for the host. Enabling this option also saves memory by reading the file from the primary host’s directory. Note that this option is disabled for the primary host.

Phrase Filtering

Use this section to configure the Phrase Filtering options. You can enable/disable phrase searching for the current host, create and maintain the phrase list , and specify an action to take when an e-mail contains one of the phrases. The list box displays the contents of the phrase list.

Procedures:

Adding Phrases to the Phrase List

Editing the Phrase List

Removing Phrases from the Phrase List

Options:

Enable (selected by default). Select this option to enable phrase filtering. If this option is cleared, all other options under phrase filtering are disabled.

Spam Action. Specify what action to take if a message contains one of the phrases from the phrase list.

•	Delete. Immediately deletes the message.

•	Forward to (default). Forwards the message to an e-mail address.  You must also enter an e-mail address in the text box to the right of this option. If no address is entered, messages will be sent to the root address and stored in a mailbox called "bulk". Example

•	Insert X-Header. Inserts an X-Header into the message denoting that the message contained a phrase that is in the phrase list. See also X-Header Explanations.

Note: For more spam options see Using Delivery Rules to Filter Spam.

Content Filtering for Authenticated Users. Select this option to enable content filtering for all messages that are received from authenticated users.

Note: Even if the above option is selected, content filtering is not performed on messages that are sent from system and host administrators.  This prevents mail from being filtered twice in cases where a message is misidentified as spam and the administrator then forwards it on to its intended recipient.

Tip: It is recommended that you select the Forward To option instead of Delete until you know that the anti-spam options are setup correctly for your system. This way if some messages are incorrectly identified as spam, you can still access them and send them to their correct address.

Related Topics:

Advanced Statistical Filtering Options

White List Button

Creating a New antispam-table.txt File for a Host


Exclude List (definition)

A list of words that are not to be included in determining whether a message is spam. The words in the exclude list are words that have an equal chance of being non-spam as spam. For example, "Mortgage " is a term frequently used in spam. However, if you work in the financial industry, this term may appear frequently as non-spam. In such a case, you would enter the word "mortgage" into the exclude list.  The exclude list should also include common words like html tags, and proper names. The exclude list is stored in the exclude-list.txt file located in the host’s directory.


Phrase List (definition)

The phrase list contains a list of spam phrases. For example, if you frequently receive spam that uses the phrase "wholesale products" then you would enter it into the phrase list. Phrases are stored in the phrase-list.txt file, which is located in the host’s directory.


Reverse DNS Lookup Example

If you have the IP address of 156.21.50.255 and perform a reverse DNS lookup, the address would now look like 255.50.21.156.in-adda.arpa. This IP address is used to lookup and verify the domain name.


Getting to the Content Filtering tab

1	In the left panel, expand the localhost, and select a host with an IP address.

2	Under the host, select the Antispam folder.

3	In the right panel, click the Content Filtering tab.


Adding a Word to the Exclude List

1	Under Statistical Filtering, click Add to display the Add a word dialog box.

2	In the Add a word dialog box, enter the word you want to exclude and click OK. The word must be between 1 and 15 characters.

3	To save the exclude list, click Apply at the top of the right panel.

Note: If you do not click Apply, the word will not be displayed when the screen is refreshed.


Editing a Word in the Exclude List

1	Select the word from the list box under Statistical Filtering and click Edit.

2	Make any desired changes in the Edit the Word dialog box and click OK.

3	To save the changes to the exclude list, click Apply at the top of the right panel.

Note: if you do not click Apply, the changes will not be reflected when the screen is refreshed.


Deleting a word from the Exclude List
Removing a Word from the Exclude List

1	Select the word from the list box under Statistical Filtering, and click Remove.

2	To save the changes to the exclude list, click Apply at the top of the right panel.

Note: if you do not click Apply, the word will reappear when the screen is refreshed.


Adding Phrases to the Phrase List

1	Under Phrase Filtering click Add.

2	Enter the word or phrase in the Add a Phrase dialog box, and click OK. The phrase must be between 1 and 255 characters.

3	The phrase now appears in the list box under Phrase Filtering on the Content Filtering tab.

4	Click Apply at the top of the right panel, to save the new phrase-list.txt file.

Note: If you do not click Apply, the phrase will not be displayed when the screen is refreshed.


Editing the Phrase List

1	Select the word or phrase from the list box under Phrase Filtering and click Edit.

2	In the Edit the Phrase dialog box, make any desired changes to the phrase and click OK.

3	Click Apply, at the top of the right panel, to save the changes to the updated phrase-list.txt file.

Note: If you do not click Apply, the changes will not be reflected when the screen is refreshed.


Deleting Phrases from the Phrase List
Removing Phrases from the Phrase List

1	Under Phrase Filtering, select the phrase you want to delete from the list box.

2	Click Remove.

3	Click Apply, at the top of the right panel, to save the changes to the phrase-list.txt file.

Note: If you do not click Apply, the phrase will reappear when the screen is refreshed.


Advanced Statistical Filtering

Getting to the Advanced Statistical Filtering dialog box

These options control the underlying functionality of the statistical filtering feature, and are dependant upon each other to effectively identify spam. If you have a significant number of legitimate messages that are being identified as spam or vice versa, you may need to adjust these options.

Note: The default settings are appropriate for most systems. It is strongly advised that ONLY experienced administrators modify these settings. Setting these options too high or too low will hinder the ability of IMail Server to identify spam.

•	Treat a word as new until its total occurrences exceeds. Values Refers to the minimum number of times that a word must occur in spam and non-spam e-mail before statistical information is stored for it. Until a word occurs the number of times entered here, it is considered a new word.

•	The probability a new word is spam. Values The percentage assigned to new words to determine if they are spam. Example

•	An email is spam when its calculated probability exceeds. Values This option sets the minimum probability percentage at which a message will be identified as spam. Messages with probability values below the value entered here, are identified as non-spam. Messages with probability values above this value are identified as spam. Example

•	Maximum number of words to use in calculating an emails probability. Values The number of individual word values, within each e-mail, used to calculate the probability that an e-mail is spam.

Related Topics:

Statistical Filtering

Content Filtering


Add a Phrase dialog box

Enter the phrase that you want to add to the phrase list. Each phrase must be between 1 and 255 characters, including spaces. The phrase may include all special characters including hyphens, parentheses, quotation marks, etc.


Getting to the White List dialog box

1	In the left panel expand the localhost, and select a host with an IP address.

2	In the right panel, click the Content Filtering tab.

3	At the bottom of the Content Filtering tab, click White List.


Statistical Filtering (definition)

Statistical Filtering examines each word in an e-mail message and evaluates how often the word appears in spam and non-spam e-mail. The entire message is then evaluated based on all of the word values to determine whether it is likely to be spam.


Phrase Filtering (definition)

Phrase Filtering searches for specific spam phrases within the body of e-mail messages. You can edit the list of phrases, and specify an action to take when an e-mail contains one of them. The phases are stored in the Phrase-list.txt file, which is located in the host’s directory.


White List (definition)

The white list is a list of e-mail addresses and domains from which mail is always accepted. Mail from any of the entries in this list is processed immediately and does not go through the other anti-spam checks.


Server black lists
Server DNS Black Lists

Server level DNS black lists are spam databases that store information about IP addresses that are known to send spam. IP addresses that have open mail relays (relays mail for anyone) are also commonly listed in black lists, because those servers have the potential to be easily hijacked by spammers. Each black list compares the IP addresses from which an e-mail is sent against the spam database to look for a match. If a domain’s IP address is listed in one of the black lists, mail from that domain should be suspected of being spam.


Adding a Server Level Black List

1	Click Add to open the Add Server Black list Entry dialog box.

2	Enter the requested information for the black list, and click OK.

3	To save the black list properties, click Apply at the top of the right panel.

For detailed information on how to set the server black list options, click Help on the Add DNS Black List dialog box.


Modifying a Black List
Editing a DNS Black List for the Server

1	Select the black list from the list box on the DNS Black Lists tab, and click Edit. The Add Server Black list Entry dialog box appears.

2	Make desired changes to the black list options and click OK.

3	Click Apply, at the top of the right panel, to save your changes.

For detailed information on how to set the server black list options, click the Help button on the Add DNS Black List dialog box.


Deleting a Black List
Removing a DNS Black List

1	Select the name of the black list from the list box on the DNS Black Lists tab.

2	Click Remove.

3	Click Apply, at the top of the right panel, to save your changes.

Note: If you do not click Apply, the black list will still be displayed when the screen is refreshed.


Host Level Black Lists

Each black list that is enabled for the server, can be enabled/disabled for each host. If a black list is not configured for the server, it cannot be used by a host, and will not be displayed on the Connection Filtering tab. All host's black list entries are stored in the spamblks.txt file, which is located in the each host's top directory.

IMail Server allows you to separate DNS black lists into the following two types:

•	DNS Black Lists (insert X-headers). These are black lists for which you want to review the messages that match it. If an e-mail matches the criteria of any of these black lists, an X-Header is inserted in the message indicating which black list it matched and why. The e-mail is then passed on to content filtering for further examination. The message is delivered if no other rules processing takes place.

Host administrators have the option of specifying that a message should be deleted if it matches a specific number of standard DNS black lists plus the number of enabled verification checks. See Connection Filtering for more information.

•	Trusted DNS Blacklists (immediate deletion). These are black lists that you trust to be accurate. If an e-mail matches any criteria in these black lists, the message is immediately deleted.

The difference between a standard and a trusted DNS black list is in the way that the message is handled if it matches a black list.

Related Topics

Enabling Black Lists for a Host

Server Black Lists Overview


Enabling a DNS Black List for a Host

Getting to the Connection Filtering tab

By default, there are no black lists enabled at the host level. The host administrator must enable black lists for the host immediately after installation.

1	Decide whether you want the black list to be a standard DNS Black list, or a trusted DNS Black list.

2	Click Add in the appropriate grouping to open the Add DNS Black list dialog box.

3	Select a black list and click OK.

Note: Only blacklists that have been configured for the server are displayed in the Add DNS Black List dialog box.

4	To save this black list, click Apply at the top of the right panel.


Removing a Blacklist
Removing a DNS Black List (host)

Getting to the Connection Filtering tab

1	Select the black list name from either the DNS Blacklists list box, or the Trusted DNS Blacklists list box.

2	Click Remove, and the DNS black list entry will no longer be displayed.

3	Click Apply, at the top of the right panel, to save your changes. If you do not click Apply, the black list will reappear when the screen is refreshed.


Content Filtering

Content filtering uses phrase filtering and statistical filtering to examine e-mail messages. Phrase filtering searches for phrases that are often indicative of spam. Statistical filtering examines each word and assigns it a value based on the probability that it is spam. All of the word values for each message are then compiled to determine if the message is spam.


Values for Minimum number of words
Values for "Treat a word as new until its total occurrences exceeds"

This option can be set to any positive number between 2 and 10. By default it is set to 5.

Note: The greater the value, the greater number of words that are treated as new words. Depending on the value for The probability a new word is spam option, this may cause statistical filtering to be improperly biased one way or another.  Also note that the higher the value, the less likely any message will be treated as spam.


Values for "Probalility a new word is spam"
"Probability a new word is spam" Values

Enter any value between 0 and 100%. The default is 40%.

The higher the value, the more likely a new word will be treated as if it had previously appeared in spam e-mail messages. The lower the value, the more likely a new word will be treated as if it had previously appeared in non-spam e-mail messages. For example, if you enter 0, every new word will be treated as if it were non-spam. If you enter 100%, every word will be identified as spam.

It is recommended that this value not be set higher than 40%. The idea behind setting this option at 40% or less, is to bias the statistical analysis in favor of being legitimate e-mail thereby reducing the likelihood of a false positive.


Values for "Number of words to use in determining spam"
Values for "Maximum Number of words to use in calculating an e-mail’s probability"

You can enter any value in this textbox. However, entering anything above 25 may have unpredictable results. The default is 15.

Note: The value for this option can greatly affect the performance of statistical filtering. The greater the value, the more time is spent determining which words to evaluate within a message. Thus, statistical filtering takes longer to calculate the e-mail probability and mail processing takes longer.


Values for "Spam probability benchmark"
Values for "An e-mail is spam when its calculated probability exceeds"

Enter a value between 0 and 100%. The default is 90%. The closer the value is to 100%, the less likely that spam will be caught. The closer the value is to 0, the greater the probability that you will have false positives.

Example: Suppose this option is set to 80%. If an e-mail message is processed and the combined probability for all of the word values within it is 60%, then this message is identified as non-spam, because it does not meet the probability benchmark of 80%.


Probability (definition)

The statistical likelihood that an e-mail is spam.


Troubleshooting

Spam is not being redirected to the mailbox entered in the "Forward To" field.

By default, spam is sent to "root-bulk". Note that this is a sub-mailbox, which did not previously exist on your system. If the host has the Sub-mailbox Creation option set to Bounce or Send to Inbox, then the spam will be redirected. See Mail Host Properties for information on how to change the sub-mailbox option.

My Max Mailbox size has been exceeded.

If you chose to forward spam messages to a mailbox, and receive a large quantity of spam, it is possible that the max mailbox size defined for the host has been exceeded. To remedy this, either delete some of the spam from the mailbox, or increase the max mailbox size.  To ensure that you are notified of this situation in the future, you may want to set up a Full Mailbox Notify Address, so that you will receive an e-mail when the mailbox is near capacity. See Mail Host Properties for more information.

I am still getting spam.

It is not possible for IMail Server to eliminate all spam. It is inevitable that a small percentage will still get through to your mailbox. However, you can adjust the Advanced Statistical filtering options to increase the performance of IMail Server’s anti-spam component.

There are no black lists available for the host.

If there are no black lists displayed on a host’s Add DNS Black List dialog box, that means no black lists are enabled at the server level. See Configuring DNS Black Lists for information on how to enable black lists for the server.

IMail Server is running extremely slowly.

If you have enabled any of the verification options, this could cause a slowdown.  See Connection Filtering for more information on the verification options.

Spam is not being sent to the correct mailbox.

Make sure that the mailbox you want spam sent to is entered in the Forward To field on the Content Filtering tab.  If the correct mailbox is displayed, check to see if the host has an inbound delivery rule that may be trapping the message and sending it to a different mailbox.

Legitimate e-mail is being identified as spam (False Positives).

There are several reasons why a legitimate message may be identified as spam. First, make sure that the IP address is not listed in a black list. Do this by examining the message header for the "X-IMAIL-SPAM:" line. Second, see if the message failed any verification checks. Sometimes, even legitimate SMTP servers have wrong DNS records. If the message is identified as spam by content filtering, you need to use the antispamseeder.exe utility to alter the antispam-table.txt file.

Some of my users cannot send outgoing mail.

You can do two things to assure that your users mail is delivered. First, you can enter your mail server’s domain name into the white list. You can also make sure that the Content Filtering for Authenticated Users option on the Content Filtering tab is not selected. Note that the second option should only be used if you trust all of your users not to send spam.

I have setup a "Spam" mailbox for to which all spam messages are sent, but some of my users cannot see this mailbox. Why?

The "spam" sub-mailbox is not created until the user account receives spam, so it is possible that the account has not received any spam. If the users are POP3 users, they will not see the "spam" mailbox unless they login using the format userid-spam.


Accessing Server Level Anti-Spam Options

1	In the left panel, expand the localhost, and select the Antispam folder.

2	In the right panel, the server level options appear on the DNS Black Lists and Logging tabs.


Accessing the Host Level Anti-Spam Options

1	In the left panel, expand the localhost and select a host with an IP address.

2	Under the host, select the Antispam folder.

3	In the right panel, the host level anti-spam options are displayed on the following tabs: Connection Filtering, Content Filtering and Trusted IP Addresses.


Changing a Black List Type

A black list cannot be both a DNS blacklist and a trusted DNS black list. If you have enabled a black list as one type and attempt to add it to the other type, it will not be available for selection. To change a DNS black list from one type to another, you must first remove it from its current type. The example below assumes you are attempting to change a black list from a standard DNS black list to a trusted DNS black list.

1	Select the black list name from the DNS Black List box on the Connection Filtering tab, and click Remove.

2	Click Add in the Trusted DNS Black List grouping. The Add DNS Black List dialog box opens.

3	Select the black list name that you previously deleted, and click OK.  The black list now appears in the Trusted DNS Black List grouping.

4	Click Apply, at the top of the right panel, to save your changes.


Log Files Example

11:21 15:26 SMTPD(006D0364) [00001316] <domain1> BLACKLIST: connecting to service (FIVETEN.www.five-ten-sg.com:blackholes.five-ten-sg.com)

11:21 15:26 SMTPD(006D0364) [00001316] <domain1> BLACKLIST: 156.21.50.255 was found on list (FIVETEN.www.five-ten-sg.com:blackholes.five-ten-sg.com) -> blocked by :blackholes.five-ten-sg.com

11:21 15:26 SMTPD(006D0364) [00001316] <domain1> VALIDATION: (MAIL FROM) domain 1 validating MAIL FROM address testacct@unknown

11:21 15:26 SMTPD(006D0364) [00001944] <domain1> VALIDATION: (MAIL FROM) domain1 FAILED to connect to unknown

11:21 15:26 SMTPD(006D0364) [00001944] <domain1> VALIDATION: (MAIL FROM) <testacct@unknown> user does not exist on remote system


antispamseeder.exe
Antispamseeder.exe Overview

The antispamseeder.exe utility, located in the IMail top directory, is used to manage the spam and non-spam word counts contained in the antispam-table.txt file. You can use this utility to modify the antispam-table.txt file in the following ways:

•	Re-assign the word counts contained in the antispam-table.txt file, when e-mail is incorrectly identified as spam (false positive), or vice versa. This increases the likelihood that such messages will be correctly identified in the future.

•	Create a new antispam-table.txt file that applies only to a specific host.

•	Add new words to the antispam-table.txt file.

•	Delete words from the antispam-table.txt file that do not occur very often to decrease the size of the file.

•	Enter wildcards(i.e. g* *d) into the antispam-table.txt file so that statistical filtering will identify such words as spam.

Note: If any of the procedures listed below are performed by a secondary host, that host will either need to copy antispamseeder.exe to the secondary host’s directory, or access antispamseeder.exe from the primary host’s directory.

Procedures:

Resolving incorrectly identified e-mail

Creating a host's antispam-table.txt file

Customizing a host's antispam-table.txt file

Adding new words to the antispam-table.txt file

Modifying the word counts in the antispam-table.txt file

Deleting infrequent words from the antispam-table.txt file

Identifying wildcards in e-mail

Parameters

The following parameters can be placed in any order within the command.

Related Topics

Understanding the Antispam-table.txt file


Creating a Host's Antispam-table.txt file
Creating Separate antispam-table.txt files for Multiple Hosts

There may be occasions where a secondary host does not want to use the primary host’s antispam-table.txt file because they do not agree on what words are spam. Or perhaps, the administrator for the primary host is not satisfied with the antispam-table.txt file that ships with the product (click here for an example). In these cases, the antispam-table.txt file will need to be altered.

Creation of the spam and non-spam word counts for a host, can be accomplished in the following ways:

•	Use the contents of the antispam-table-ini.txt file, which is a copy of the word counts that are created during installation. This file contains the initial word counts, it does not contain changes that were made by the primary host.

•	Use the antispamseeder.exe utility to create new word counts in the antispam-table.txt file for the host. This option is used to take the above option a step further, and customize the word counts specific to the secondary host.

Using the Primary Host’s antispam-table.txt File for a Secondary Host

Note: This option is enabled by default upon installation.

1	In the left panel expand the localhost and select a host that has a valid IP address.

2	Under the host, select the Antispam folder.

3	In the right panel, click the Content Filtering tab and select Use Primary AntiSpam Table.

4	IMail Server reads the antispam-table.txt file from the primary host’s directory each time that content filtering is performed on a message. Therefore, this file will not appear in the secondary host’s directory.

To Create a New antispam-table.txt File

In the left panel expand the localhost and select a host that has an IP address.

1	Under the host, select the Antispam folder.

2	In the right panel, click the Content Filtering tab and clear Use Primary AntiSpam Table.

When the above option is cleared, the contents of the antispam-table-ini.txt is placed in the secondary host’s directory, and is ready for modification. This file is a copy of the primary host’s antispam-table.txt file that was created during the installation process.

3	Click OK at the bottom of the Content Filtering tab to save your changes.

4	To modify the word counts within the antispam-table.txt file, you must use the antispamseeder.exe. For information on how to use this utility see Customizing a host's antispam-table.txt file.

Note: If the secondary host’s directory already contains an antispam-table.txt file, you must delete it before clearing the Use Primary AntiSpam Table option. If you do not delete it, the antispam-table.txt file will not be copied to the directory and the word counts will not be updated. You can also backup this file to another location in case you decide to revert back to it later.

Related Topics

Understanding the Antispam-table.txt file


Antispamseeder.exe Example
Antispamseeder.exe Example (creating the spam word counts)

If your host's name is "Host1", and your mailbox name is "spam", you would enter the following command: antispamseeder.exe -spam -hHost1 -mC:IMail\Host1\users\root\spam.mbx


Antispamseeder.exe Example(good seed)
Antispamseeder.exe Example (creating the non-spam word counts)

If you have a host named "Host1" and a mailbox named "good", you would enter the following command:

antispamseeder.exe -good –hHost1 -mC:\IMail\Host1\users\root\good.mbx.


hostname

Enter the name of the host for which you are creating the antispam-table.txt file.


mailboxpath
mailbox

If the mailbox resides in the same directory as antispamseeder.exe, type the name of the mailbox(.mbx) that contains the messages that you want to add to the antispam-table.txt file.  If the mailbox does not reside in the same directory as antispamseeder.exe, type the full path of the mailbox.


Example of X Number of Matches
"X Number of Matches" Example

If you have 1 DNS black list configured and three verification options enabled, the maximum value for this option would be 4.


Delivery Rules for a Host

Host rules can be created on either the Inbound Rules tab or the Outbound Rules tab. Simply select a host and then click the appropriate tab.


Delivery Rules for a User

Delivery rules for a user can be created on either the Inbound Rules tab or the Outbound Rules tab. Simply expand the users folder for any host, select a user ID, and select the appropriate tab.


Active Connection Verification
Verification Tests

Choose any of the following tests to perform on incoming e-mail messages. If a message fails any of the enabled tests, it is immediately deleted.

•	Verify MAIL FROM Address. Validates the address passed in the MAIL FROM command. The SMTP server in question will be queried to verify that the user exists. If the user does not exist the message is identified as spam.

•	Perform reverse DNS lookup for connecting server. A reverse DNS query will be made using the address of the connecting SMTP agent. If the query does not resolve to a name the message is identified as spam.

•	Verifiy HELO/EHLO Domain. Performs a DNS query for the domain passed in the HELO/EHLO command. An "A" record or "MX" record must exist for the domain in question or the mail is identified as spam.

Note: The above options are resource intensive and may slow down your IMail Server.


Probability a new Word is Spam Example
"Probability a new Word is Spam" Example

If this option is set to 20%, a new word will be treated as having appeared in spam e-mails 20% of the time and as having appeared in non-spam e-mails 80% of the time.


New Word (definiton)

A new word is any word that has appeared less than the number of times entered in the Minimum number of words option, and therefore has no statistical information available for it.

All new words are assigned a probability equal to the value entered in the probability a new word is spam option. Once a word has occurred the Minimum number of times, it is assigned a probability based on whether it is likely to be spam.


Authenticated Users

Authenticated users are users who have SMTP Authorization enabled on their e-mail client. By default, IMail Server forces users to authenticate, unless you enter their IP address in the Access Control dialog box. This means that every time they connect to the IMail Server, they must enter their user ID and password.


Pre-configured black lists
Pre-configured DNS Black Lists

All of the following DNS black lists are enabled by default for the server. These black lists are provided for your convenience so that the anti-spam can run immediately after installation. Note, Ipswitch, Inc. does not endorse any of the black lists, nor can we ensure their accuracy.

 By default, the Server field contains a asterisk ( * ) for all default and new black lists. When an asterisk is entered, the default IMail Server DNS is used for black list queries. The default DNS server relays the DNS query to the DNS server for the black list. Therefore, if an asterisk is entered, you do not need to enter the IP address or domain of the black list.


antispam-table-ini.txt file
The antispam-table-ini.txt File

The antispam-table-ini.txt file is a copy of the antispam-table.txt file that is installed for the primary host during the installation process. This file is automatically copied to a secondary host's directory if a host decides to maintain its own word counts by deselecting the Use Primary Anti-Spam Table option on the Content Filtering tab.

Note: When reinstalling IMail Server, you are asked whether you want to overwrite the antispam-table.txt file. If you select Yes, the contents are completely overwritten, and you may lose any customizations that you have made. If you select No, the updated word counts are placed in a file called antispam-table.ini.txt. If you want to update your antispam-table.txt file, you must manually copy the contents of the antispam-table.ini.txt file into the antispam-table.txt file.


Logging Tab

Getting to the Anti-Spam Logging tab

This tab allows you to configure the logging options for the anti-spam components. You can select from the following four logging options:

•	No Log. Select this to turn off the logging of events.

•	spamMMDD.log (selected by default). This sends event information to a file of this name where MM is the month and DD is the day the log was written. This file is stored in the Spool directory.

•	App Log. This sends event information to the Windows Application Log (viewed with the Windows Event Viewer).

•	Log Server. This sends event information to the Log Server file indicated on the Log Files tab.

Verbose Logging. This option records more information than standard logging, such as changes to anti-spam settings, and entries in the white list or exclude list. This option can create a very large file and may be resource intensive, however, it is especially helpful in troubleshooting issues.

Related Topics

Anti-Spam Log Lines

Anti-Spam X-Header Explanations


Getting to the Anti-Spam Logging tab

1	In the left panel, expand the localhost and select the Antispam folder.

2	In the right panel, click on the Logging tab.


Customizing a host's antispam-table.txt file
Customizing the antispam-table.txt File

To create new word counts specific to the host, instead of using the ones for the primary host, you must create the antispam-table.txt file using known spam and non-spam e-mail. To do this, complete the following steps:

1	Identify which mailboxes you will use to create the antispam-table.txt file. You will need at least two mailboxes, one that contains only spam messages, and one that contains only non-spam messages. Make sure that each mailbox contains relatively the same number of e-mails.

Note: If one mailbox contains substantially more e-mail messages than the other, the word counts will be skewed and content filtering may not function correctly.

2	Create the spam word counts within the file. Do this by entering the following command in the command prompt substituting the hostname and mailbox with your host name and the name of the mailbox that contains spam messages:

antispamseeder.exe -spam –h<hostname> –m<mailbox>

Example

Note: The mailboxes should be placed in the same directory as antispamseeder.exe. If the mailboxes are in a separate directory, you must enter the full mailbox path.

3	Create the non-spam word counts within the file. Do this by entering the following command in the command prompt substituting the hostname and mailbox with your host name and the name of the mailbox that contains non-spam messages:

antispamseeder.exe –good –h<hostname> –m<mailbox>

Example

4	The antispam-table.txt in the host’s directory is now updated with the new  word counts.

Related Topics

Understanding the Antispam-table.txt File


Using Antispamseeder.exe to Identify Wildcards

When IMail Server scans an e-mail, it breaks the e-mail down into the individual words. Each character in each word is then checked to make sure it is a valid character. By default, IMail Server does not recognize non-alphabetic characters (except hyphens), or numbers. When comparing words to the antispam-table.txt file, non-alphabetic characters and numbers in a word are treated as the "-" character. So if the word "2Sexy" is found in an e-mail, it is treated as "–sexy" when it is compared to the antispam-table.txt file.

If you want IMail Server to identify such words as spam or non-spam, you must enter them into the antispam-table.txt file, using antispamseeder.exe. To do this, complete the following steps:

1	From the command prompt, enter the following command:

antispamseeder.exe –w<word> –c<word count> [-spam/-good] -h<hostname>

2	The word that you entered in the above command will now be identified as either spam or non-spam, depending on which parameter you entered.

Note: The word count must be positive, and must be greater than the value entered for the Minimum number of words option on the Advanced Statistical Filtering dialog box.

Examples

Example 1

Example 2

Parameters

Related Topics

Understanding the Antispam-table.txt File


Using Antispamseeder.exe to purge infrequent words
Using Antispamseeder.exe to Delete Infrequent Words

You can use antispamseeder.exe to delete words, from a host’s antispam-table.txt file, that occur infrequently. You may want to delete these words to save space and speed up content filtering. This command works by eliminating all words that have occurred less than the number of times specified.

1	To determine if you need to perform this procedure, open the antispam-table.txt file, located in the host’s directory, and see if there are a significant number of words that have occurred infrequently. See understanding the antispam-table.txt file for information on how to determine this.

2	From the command prompt, enter the following command:

antispamseeder.exe -x –c<total word count> -h<hostname>

Note: The number entered for the total word count must be positive. It is a good idea to use the value entered for the Minimum number of words on the Advanced Statistical Filtering dialog box as the total word count.

3	The words that have occurred fewer times than the total word count entered in the command are removed from the antispam-table.txt file.

Example

If you want to remove all words from the antispam-table.txt file that have occurred fewer than five times in all e-mail messages, enter the following command, where "Host1" is the name of the host:

antispamseeder.exe –x –c5 -hHost1

After running the above command, and reopening the antispam-table.txt file, you will notice that all words that had previously occurred less than five times are gone.

Related Topics

Understanding the Antispam-table.txt File


Getting to the Advanced Statistical Filtering dialog box

1	In the left panel, expand the localhost, and select a host with an IP address.

2	Under the host, select the Antispam folder.

3	In the right panel, select the Content Filtering tab, and click Advanced.


Resolving Incorrectly Identified E-Mail

When IMail Server incorrectly identifies a mail message (false positive), you can use antispamseeder.exe to add statistical information about the e-mail into the antispam-table.txt file to rebalance the spam and non-spam word counts. This will increase the likelihood that similar e-mail messages will be correctly identified in the future.

To change the word tables to recognize messages that are incorrectly identified as spam(or vice versa)

If you have a significant number of messages that are incorrectly identified as spam, you can place the messages in a mailbox and add the entire contents of the mailbox to the antispam-table.txt file at once. The following procedure explains what to do when legitimate messages have been identified as spam:

1	Place all of the incorrectly identified e-mail(non-spam) in a single mailbox. Make sure that this mailbox contains only non-spam.

2	Create the non-spam word counts within the file by entering the following command in the command prompt substituting the hostname and mailbox with your host name and the name of the mailbox that contains the incorrectly identified(non-spam) messages:

antispamseeder.exe –good –h<hostname > –m<mailbox>

Example

3	The antispam-table.txt in the host’s directory is now updated with the new word counts.

Related Topics

Understanding the Antispam-table.txt File

Modifying the Word Count of Existing Words


reading the antispam-table.txt file
Understanding the antispam-table.txt File

The antispam-table.txt file contains the word counts that content filtering uses to determine if a message is spam. Each word is assigned three values. The first value is the statistical value assigned by the anti-spam engine. The second value is the number of times that the word has occurred in non-spam e-mail messages. The third value is the number of times that the word has occurred in spam e-mail messages.

It should be noted that the antispam-table.txt file was created using e-mail messages and words that were received at our company. You may find that the words and values contained in it are not entirely appropriate for your use. In this case you can customize the file based on your needs by using the antispamseeder.exe utility.

For more information on reading the antispam-table.txt file, see the Anti-Spam Setup Guide.


Verification Tests

Select which of the following connection verification tests to perform on incoming e-mail messages. If a message fails any of these tests, an X-Header is inserted into the message, indicating which test it failed.

•	Verify MAIL FROM Address. Verifies the address passed in the MAIL FROM command. The SMTP server in question will be queried to verify that the user exists. If the user does not exist the message is identified as spam.

•	Perform reverse DNS lookup for connecting server. A reverse DNS query will be made using the address of the connecting SMTP agent. If the query does not resolve to a name the message is identified as spam.

•	 Verify HELO/EHLO Domain. Performs a DNS query for the domain passed in the HELO/EHLO command. An "A" record or "MX" record must exist for the domain in question or the mail is identified as spam.

Note: The above options are resource intensive and may slow down mail processing.


Changing the Word Count for a Word Example
Changing the Word Count for a Word (Example)

If you want to alter the entry for the word "graciously" in the antispam-table.txt file, so that it is treated as spam, enter the following command (where 10 is the word count that you want to assign to the word "graciously", "Host1" is the hostname, and "graciously" is the word).

In essence, you are altering the entry for the word "graciously" in the antispam-table.txt file, thus increasing the likelihood that this word will be identified as spam in future e-mails.

Before running the above command, the entry for this word looked like this in the antispam-table.txt file:

graciously,583326,14,2

After running the above command, the entry looks like this in the antispam-table.txt file:

graciously,583326,14,10


Using AntiSpamseeder.exe to Enter a New Word into the antispam-table.txt File

You can use antispamseeder.exe to enter a new word into the antispam-table.txt file, as well as assign a word count to the word.

To enter a new word into the antispam-table.txt file and assign a word count to it

1	From the command prompt, enter the following command:

Antispamseeder.exe –w<word> –c<word count> <-spam/-good> -h<hostname>

The word you enter should be a word that does not currently exist. For the word count, enter any value between 1 and the value that you have set for the Minimum number of words option on the Advanced Statistical Filtering dialog box.

2	When this is done, the queue manager is notified and the word values contained in the antispam-table.txt file are automatically reloaded to include the word that you entered in the above command.

Example

Related Topics

Understanding the Antispam-table.txt File


Word Values

Each word within an e-mail is assigned two word counts: the number of times the word has occurred in spam, and the number of times that the word has occurred in non-spam. The values for each word are stored in the antispam-table.txt file.


Total word count

The total number of times a word has occurred in both spam and non-spam.


Word

This is word you want to add to the antispam-table.txt file. The word must comply with the following rules:

•	It must be between 4 and 15 characters.

•	It cannot contain any non-alphabetic characters except a hyphen.


Word count

The word count you want to assign to a word. For example, suppose you enter the following command:

-wstart -c10 -spam -hHost1

The word "start" is now treated as if it has appeared in 10 spam messages.


Anti-Spam Log Messages

To view a list of all possible anti-spam log messages and their explanations, click the following links:

Connection Filtering Log Messages

Content Filtering Log Messages

Log Message Components

Anti-spam log lines contain all or some of the following components.

•	All log messages are preceeded by the following line:

month:day hour:minute app_name(connection_ID)

Details

•	Most log messages also have the following line:

[message_id] <domain>

Details

•	Many black list log messages refer to the configured black list as a service and identify the black list by the following line:

(name:server:query_domain)

Details


Trusted IP Addresses Tab

Getting to the Trusted IP Addresses tab

This tab allows you to enter an IP address or range for which no spam checking is performed. The IP addresses displayed on this tab are stored in the spamskip.txt file, which is located in the host’s top directory.

Adding IP Addresses

1	Click Add, and enter the IP address and NetmaskNetmask into the Add Trusted IP Address dialog box.

2	When you are done, click OK on the Add Trusted IP Address dialog box.

3	Click Apply at the top of the right panel, to save your changes.

Editing IP Addresses

1	Click Edit, and enter the IP address and NetmaskNetmask into the Add Trusted IP Address dialog box.

2	When you are done, click OK on the Add Trusted IP Address dialog box.

3	Click Apply at the top of the right panel, to save your changes.

Removing IP Addresses

1	To remove an IP address, select it in the list box and click Remove.

2	Click Apply at the top of the right panel, to save your changes.

Related Topics

Add/Edit Trusted IP Address dialog box


Do I need to alter the word tables
Do I Need to Alter the Word Counts in the antispam-table.txt file?

The antispam-table.txt file, that ships with the product, is appropriate for most users. However, you may need to alter this file if we have identified words as spam that you do not consider to be spam, or vice versa. For example, the word "mortgage" is identified as spam because in our tests, it occurred 370 times in non-spam, and 714 times in spam. However, at financial institutions, the word "mortgage" is a non-spam word that occurs frequently. In this case, you need to alter the antispam-table.txt file so that the anti-spam engine recognizes the word "mortgage" as non-spam.


probability

The probability is the likelihood that the message is spam. Each e-mail is assigned a probability based on the number of spam and non-spam words it contains.


Example

If the word "Stop" appears in an e-mail for the first time, it is considered a new word and assigned a probability of 40% (Probability a new word is spam). If you have the "Spam email probability benchmark" set to 90%, then "stop" is not considered to be spam. In order for "stop" to be considered spam, its probability will have to increase from 40% to 90%.


Getting to the Trusted IP Addresses tab

1	In the left panel, expand the localhost, and select a host with an IP address.

2	Under the host, select the Antispam folder.

3	In the right panel, select the Trusted IP Addresses tab.


Add/Edit Trusted IP Address

1	In the Address text boxes, enter the IP address for which you do not want to perform spam filtering.

2	In the Netmask text boxes, enter the subnet mask for the computer or group of computers for which you do not want to perform spam filtering.

Example

If you have a class C address space of 156.21.50.0, enter an Address of 156.21.50.0 and a Netmask of 255.255.255.0. This will prevent IMail Server from performing spam filtering on those 254 systems.


Max Num of Words word value def
Word Value (definition)

Each word within an e-mail is assigned two word counts: the number of times the word has occurred in spam, and the number of times that a word has occurred in non-spam. From these values, a spam probability is computed for the word. This setting examines the words whose probabilities deviate most from an average word. These words are both spam and non-spam words.

Example

Suppose this option is set to 15. Since most words have an average spam probability of 50% (50% likely to be spam, 50% likely to be non-spam), then the fifteen words that are farthest away from 50% are used.  So if a word has a spam probability of 5% it will most likely be used. Likewise, if a word has a spam probability of 90%, it will most likely be used. A word that has a 45% probability will most likely not be used.


Netmask

Also called a "Subnet Mask". A subnet mask is a mask that is used to identify what subnet a specific IP address belongs to.  By entering a subnet mask, you are specifying that the subnet should not go through any spam checks.


Minimizing False Positives

What is a False Positive?

As with any spam product, there is a chance that IMail Server may identify non-spam messages as spam. Such mistakes are called false positives.  False positives can occur in both connection and content filtering.  Example

Why Do False Positives Occur?

False positives resulting from content filtering may include newsletters and other various types of e-mail that people subscribe too. Many of these get caught by the content filters because they may contain ads that look like spam.

How to Prevent False Positives

The following methods are effective in minimizing false positives:

•	Trusted IP Address list. Add the IP address (or range of addresses) for your network to the Trusted IP Address list.  Any e-mail received from an IP address in this list will not have connection or content filtering performed on it.

•	White list. Add the address or domain of the sender to the white list. E-mails from these addresses will not undergo content filtering.

•	Delivery Rules.  Set up delivery rules to send spam to a sub-mailbox in each user's directory.  To do this, configure connection and content filtering to place X-headers in the message.  Then, create a domain rule that searches for a header that contains X-IMAIL-SPAM to place the message in a sub-mailbox (i.e. H~X-IMAIL-SPAM:spam).  Users can then make individual rules that will move messages back into the main mailbox.

•	Content filtering for authenticated users.  When a client connects to SMTPD32 and authenticates, e-mail they send will not automatically be checked by connection filtering.  If the Content Filtering for Authenticated Users option on the Content Filtering tab is not selected, mail from authenticated users will not undergo content filtering.


False Positive Example

Many black lists, used for connection filtering, return hits for domains such as yahoo.com, hotmail.com and msn.com, among others.  If you use these black lists, non-spam email from these domains may be identified as spam and processed according to the specified spam action.


Identifying Spam with Double Byte Characters

Some spam contains multi-byte character sets that are not read by IMail.  One way to treat all these multi-byte words as spam is to add words of all dashes to the word file.  The word file contains words ranging from 4 to 15 characters in length, so you would add a word of each length like this:

antispamseeder -spam –w- - - -  -c100 -hdomain.com
antispamseeder -spam –w- - - - -  -c100 -hdomain.com
antispamseeder -spam –w- - - - - -  -c100 -hdomain.com


Modifying Word Counts of Existing Words

You can use antispamseeder.exe to reassign a word’s count in the antispam-table.txt file.  You may need to do this if words are being misidentified. This will alter the word counts to increase the likelihood that the word will be identified correctly in the future. For an example of why you may need to alter the word count values, click here.

To change the word count of words that are incorrectly identified as spam(or vice versa)

1	From the command prompt, enter the following command:

antispamseeder.exe –w<word> –c<word count> [-spam/-good] –h<hostname>

2	When this is done, the queue manager is notified and the word values contained in the antispam-table.txt file are automatically reloaded.

Note: The word count must be positive. It is a good idea to use the value entered for the Minimum number of words option on the Advanced Statistical Filtering dialog box.

Example


AntispamseederWildcardEx1
Wildcard Example

Example 1

If you want the anti-spam engine to identify the word 2Sexy as spam, add it to the antispam-table.txt file by entering the following command, replacing domain.com with your domain name:

antispamseeder.exe -spam -w-sexy -c100 -hdomain.com

This command adds the word -sexy to the antispam-table.txt file as if it had occurred 100 times in spam e-mail. The word will now be treated as a spam indicator by the content filters.


AntispamseederWildcardEx2
Wildcard Example

Example 2

If you want the anti-spam engine to identify the word 2Sexy as spam, add it to the antispam-table.txt file by entering the following command, replacing domain.com with your domain name:

antispamseeder.exe -spam -w-sexy -c100 -hdomain.com

This command adds the word -sexy to the antispam-table.txt file as if it had occurred 100 times in spam e-mail. The word will now be treated as a spam indicator by the content filters.

If you want the anti-spam engine to identify the word"g00d" (with zeros) as spam, you must enter the word into the antispam-table.txt file by running the following command, substituting dashes for the non-alphabetic characters. In this example, " host1" is the hostname and "g- -d" is the word you want to be recognized as spam:

Once you run the above command, the anti-spam engine will recognize any variable of the word g- -d as spam, such as g00d, g**d etc.  This command does not change the word count for the word "good" because it does not contain any non-alphabetic characters.


Zone (definition)

Sometimes a black list contains multiple areas on the same server to differentiate why IP addresses are black listed. Each of these areas is called a zone. For example, one zone may contain a list of open relays, and another zone may contain a list of domains that are known to spam. These zones allow you to determine why an address is blacklisted. When you are configuring a black list, you may choose to use certain zones but not others. Contact the black list to determine the Query Domain zones that are available.


Preparing Mailboxes for Use with antispamseeder.exe

Before a mailbox can be used by antispamseeder to create or alter the antispam-table.exe file, several precautions should be taken.

Mailboxes Messages should be Alike

Make sure that each mailbox contains the same type of e-mail messages. For example, one mailbox should contain only spam messages, and another mailbox should contain only non-spam messages.

Mailboxes should be the Same Size

Make sure that all mailboxes contain relatively the same number of e-mail messages. If one mailbox contains substantially more e-mail messages than the other, the word counts will be skewed and content filtering may not function correctly.

Remove Extra Text

You need to clean up all forwarded e-mail messages. Sometimes, a mailbox will contain messages that were forwarded to you by a user(i.e. the message was misidentified as spam or should have been identified as spam, and the user wants it added to the good word counts). If this is the case, you will need to examine each forwarded e-mail and remove any information that was not included in the original e-mail, before using the mailbox with antispamseeder.exe. Information that needs to be removed is anything that was inserted by the user’s e-mail client when the message was forwarded, such as the following:

•	Message headers (i.e. To, From, CC, Date, Subject)

•	Original message indicators ">"

•	Anything that the user inserted into the e-mail including signatures, business cards and comments (i.e. "This message was incorrectly identified as spam").

Failure to remove the above items, may result in a inaccurate antispam-table.txt file, which will cause statistical filtering to incorrectly identify spam.


X-Header Example 2
The above X-Header indicates that the same message also failed the "Mail From" verification check.


Example X-Header1
The above X-Header indicates that the IP address of the message’s sender was found in the FIVETEN black list, which suggests that it is spam.


Default IMail Server DNS

The IMail DNS server, configured during the IMail Server installation.


root-bulk

A mailbox called "bulk" for the "root" user account


Connection Filtering Log Messages


Content Filtering Log Messages


LogMsgComponent3


logmsgcomponent


Creating a rule to filter messages listed in a black list
Creating a rule to accept messages listed in a black list for a specific reason

Suppose you want to accept all messages whose IP addresses are listed in the FIVETEN black list because they are dialups. You will know this based on the X-Header that is inserted into the message, and the IP/reason code that is returned from the black list. In the following example, 127.0.0.3 is the IP/reason code for dial up connections used by the fiveten black list. For more information on IP/reason codes, see How Black Lists Work.

1	Set up a delivery rule at either the host or user level that will search for all messages that contain the following X-Header:

X-IMAIL-SPAM-DNSBL: (FIVETEN, +\d, 127.0.0.3)

The rule looks like this in the Rules dialog box:

Header Contains X-IMAIL-SPAM-DNSBL: (FIVETEN, +\d,127.0.0.3)

2	Choose one of the following rule actions: forward, move to mailbox, or copy. For example, select Move to Mailbox and in the Address text box enter "Spam".

This rule searches for all messages whose IP addresses are in the FIVETEN black list because they are dialups and sends them to a mailbox called "Spam".

The above rule looks like this in the rules.ima file:  H~ X-IMAIL-SPAM-DNSBL:(FIVETEN):Spam

Tip: Initially, you may want to set up a mailbox specifically for spam. You can then evaluate the messages that are trapped to ensure that no legitimate mail gets caught by mistake.


Bouncing Spam Messages

To bounce a message that is identified as spam, you must set up a delivery rule at the host level. Before you setup a rule, determine the reason you want to bounce spam messages, and identify the corresponding X-IMAIL-SPAM header that is inserted into these types of messages (i.e. X-IMAIL-SPAM-DNSBL). If you want to bounce all spam messages regardless of the reason it was identified as spam, you will need to create a rule or rules that search for the generic X-IMAIL-SPAM header. Click here for a list of all spam X-Headers.

Example

This example assumes that you want to bounce all messages that are identified as spam. To bounce a message that is identified as spam, complete the following steps:

1	Make sure that all of the anti-spam features are setup to insert X-Headers.

•	On the Connection Filtering tab, black lists should only be listed in the top list box.

•	On the Content Filtering tab, the spam action for both statistical filtering and phrase filtering should be set to Insert X-Header.

2	Click on the host’s Inbound Rules tab, and click Add.

Enter the following parameters for the rule:

If the Header Text

Contains

X-IMAIL-SPAM

3	Click Add Condition, and click OK.

4	On the Inbound Rules tab, select the rule you just added and Select Bounce.

5	Click Apply to save your changes.


Sending spam to a specific folder in a user account

You can allow your users to manage their own spam, by directing all messages that are identified as spam into a folder for the user account. The user can then delete the ones that are spam, notify you of any false positives, or set up a forward file that will move specific messages into their Inbox. To create a rule that moves spam into a specific sub mailbox, complete the following steps:

1	Make sure that all of the anti-spam features are setup to insert X-Headers.

•	On the Connection Filtering tab, black lists should only be listed in the top list box.

•	On the Content Filtering tab, the spam action for both statistical filtering and phrase filtering should be set to Insert X-Header.

2	Click on the host’s Inbound Rules tab, and click Add.

3	Enter the following parameters for the rule:

If the Header Text

Contains

X-IMAIL-SPAM

4	On the Inbound Rules tab, select the rule you just added and Select Move to Mailbox. Then in the Address box, enter the mailbox name to which you want messages sent to, for example "Spam".

5	Click Apply to save your changes.

Note: The above rule looks like this in the rules.ima file: H~X-IMAIL-SPAM:Spam

Related Topics:

Creating a User Rule to redirect spam Messages to the Inbox


How Black Lists Work

DNS black lists are databases of known spammers. These databases contain a list of IP addresses that are known to send spam. They also contain IP addresses that have open mail relays, because a spammer can easily hijack these systems to send out spam. Each black list has different reasons for why an IP address is blacklisted, among the more common reasons are: dialups, bulk mailers, spammers and open relays.

Categorizing IP Addresses in Separate Domains

Just as black lists have different criteria for including IP addresses, they also have different ways of categorizing the IP addresses. Some black lists use different domains (called query domains) to separate IP addresses based on the reason they are blacklisted. One domain will contain only IP addresses for dialup accounts, another domain will contain only IP addresses for bulk mailers. This type of categorization allows you to select the reasons for which you do not want to accept black listed mail, and use the domain that contains IP addresses for that reason.

Categorizing IP Addresses by a Reason Code/IP Address

Other black lists return a reason code/IP address (i.e. 127.0.0.3) as to why an IP address is black listed. Although all IP addresses are listed in one domain, each will contain a reason code that explains why it is included. For example, a code of 127.0.0.3 may represent a dialup account, and a code of 127.0.0.4 might represent a bulk mailer. The Fiveten black list is an example of one of these black lists.

How to Determine Which Method a Black List Uses

Unfortunately, there is no standard across black lists. One black list may use separate query domains, and another may use reason/IP codes. Likewise, there is no standard across the reason/IP codes that are returned. For one black list, 127.0.0.3 may represent dial ups, and on another black list this code may represent bulk mailers. The best resource for finding out this information is the black list itself. By going to their websites, you can learn how each black list classifies the listed IP addresses.


code/IP address (i.e. 127.0.0.3)
Black List Code/IP address (i.e. 127.0.0.3)

The reason code that is returned from a black list is sometimes in the form of an IP Address. This IP address does not in any way correlate to the black listed IP address. It is simply a code that tells you why the IP address was blacklisted (i.e. because it is a bulk mailer, dialup, etc). Other black lists return a code in the form of a CNAME.


Ensuring Mailing list and Newletter delivery
Ensuring Mailing list and Newsletter delivery

To ensure that mailing list messages and newsletters are not identified as spam, place the domain name from which the mailing list/newsletter is sent in the White list. See Creating a White List.

If you do not trust the domain from which the message is sent, you can create a host rule to send the message to a folder for the user (i.e. spam), and the user can then create a rule that puts the message in their Inbox.

Related Topics

Using Delivery Rules to Filter Spam


Receiving Mailing Lists and Newsletters that are identified as spam

Sometimes, mailing lists/newsletters are identified as spam because they are sent from bulk mailers. If you do not want to place the domain from which a mailing list/newsletter is sent into the white list, you can set up a rule to delivery the message anyway. To do this complete the following steps:

If there is already a rule setup to direct spam into a specific user’s mailbox (i.e. Spam), you can simply have the user create a rule as described below:

Look at the header of one of your mailing list/newsletter messages that was identified as spam. Find the X-IMAIL-SPAM line. Copy and paste this entire line into the text area for a rule.

Create a Host Rule to Place Spam in a Specific Mailbox for Users

To set up a host rule to place all messages identified as spam in a specific mailbox, click here.

Creating a User Rule to Place Spam in the Main Mailbox

Look at the header of one of your mailing list/newsletter messages that was identified as spam. Find the X-IMAIL-SPAM line. Copy and paste this entire line into the text area for a rule. For example, if a mailing list/newsletter contains the following X-Header: X-IMAIL-SPAM-DNSBL: (fiveten,7799652 ,127.0.0.4). You would place the entire line into a rule as follows:

1	From the Inbound Rules tab, click Add.

2	On the rules dialog, select the following parameters:

If the Header Text

Contains

3	In the Search Text box, paste the X-Header from the message, and click Add Condition.

4	On the Inbound Rules tab, select the rule you just created in the upper text box.

5	Select Move to Mailbox, and in the Addresses box, enter "Inbox".

The mailing list/newsletter will now always be redirected from the "spam" mailbox to the "Inbox" mailbox.

Note: Even though you may set up a rule to deliver a mailing list/newsletter to your Inbox if it matches a black list, this does not mean that the mailing list/newsletter will not be caught by another anti-spam component. It is possible that occasionally the list will be identified as spam by content filtering because the content is similar to spam. If this happens create another rule with the new X-Header.