MailSite Knowledge Base

• MailSite 6.x
• MailSite 7.x

As Mailshell's anti-spam scanning engine analyzes messages, it calculates a spam score for each message based on techniques such as pattern matching, spam definitions, and heuristic analysis. Regular updates to the scanning engine heuristics ensure continued effectiveness against the changing tactics of spammers. The spam scores for each message can be used to determine how the message is handled by the system.

Spam Filter Rules for Managing Spam.

In general, these rules should help curb the amount of SPAM targeted at your user base. The Local mailbox filter can be entered via the MailSite console or via MailSite Express, so a MailSite user can white list or reject at will messages.

Sometimes a message is tagged as a SPAM message for various reasons, even though the message itself is not a SPAM message per say. It can be a mailing list message or an automatically generated message from a service such as Ebay.

The SPAM engine takes into account if the message has the following typical SPAM criteria:

• FROM address ends in numbers
• The message header has X_PRIORITY and this is set to HIGH
• The message was sent from an EXCHANGE_SERVER
• The message header has X_MAILER
• The message header has X_MSMAIL_PRIORITY_HIGH
• The message header has MSMAIL_PRI
• The message header is MISSING_MIMEOLE
• The message includes key SPAM words such as
  • FOR FREE
  • LOW PRICE
  • VIAGRA ONLINE
  • CLICK BELOW in capital letters
  • Link to an UNSUBSCRIBE page
  • A CLICK HERE link
• The message contains HTML_FONT_COLOR_RED or other COLORS

These results vary from message to message, but as you can see the method of determining a SPAM can sometimes cause a legitimate message to be counted as SPAM.

Example SPAM Filters.

NOTE: In order to use header tagging, you need to have SIEVE filtering enabled for all inbound messages.

From the Server > Filtering > Sieve Filter

Server Received Script

• Name: Add Spam Score X-Header
• Description: Add a Spam Score X-Header to all messages
• If <Spam Score> is <greater than or equal to> 6
• Add a X-Spam-Score header field containing the spam score
• Continue Filtering

Forced Mailbox Delivery Script

• Name: Testing on message content
• Description: Discard all messages with 'Viagra' in them
• If < Message Body> contains Viagra
• Discard Message

Mailbox Delivery Script

• Name: Spam Trap (default)
• Description: File all messages that are spam into a "Junk Mail" folder
• If <Spam Score> is <greater than or equal to> 6
• Quarantine the message to auto-purged "Junk Mail" folder
• Continue filtering

From the Domain > 'mydomain.com' > Sieve Filter

Local Domain filter

• Name: Discard Spam
• Description: Discard message if score higher than 9
• If <Spam Score> is <greater than or equals to> 9
• Discard message
• A score of 9 or higher indicates a high probability of it being SPAM, so it is best to discard it. You can reject it, but since most spammers forge the address, an innocent victim may get all the bounce backs and cause headaches for you and the other ISP

From within Express > Options > Filters

Local Mailbox filter

• Name: Whitelist
• Description: Moves messages of accepted senders to the INBOX
• If From: contains 'user@anyDomain.com'
• Move To: INBOX

• 10270:How to reduce the risk of false positives by using "White Lists" of trusted senders in MailSite Anti Spam
  
• 10303:Default anti spam scripts in MailSite
  
• 10296:What is the order of execution of Sieve Filters?