SmarterMail 5.x Help
This documentation is for a product that is no longer supported by SmarterTools.

Anti-Spam Administration

SmarterMail's anti-spam features allow you to be as aggressive as you want when combating spam.

To get started, click the Security button on the main toolbar, then select Anti-Spam Administration from the Email Protection tree view.

  • Spam Checks - Check the spam options that you want to enable for filtering (a point-based weighting system for filtering spam) and for blocking at the SMTP level. Weights can also be edited for the various checks from this tab.
  • Filtering - Choose the default weight thresholds and actions for various spam levels for filtering. Users can override these settings if you permit them to.
  • SMTP Blocking - Set the weight to use as a threshold on this tab. Enabling this option will block email at the SMTP delivery level if too many spam checks fail.
  • Options - This tab contains options relating to the processing of spam and overridability.

In short, when an email comes in, spam checks are run on it. The checks that fail add points to the email, which then put the email into a category of spam probability.


Spam Checks

Due to the flexible nature of SmarterMail's Anti-Spam setup, spam checks can influence the spam decision as much or little as you want. When spam protection runs on a particular email, all enabled spam checks are performed on the email. The total weight of all failed tests is what comprises the spam weight for the email. A spam probability level is then assigned to the email using the settings in the Filtering tab.

Note: Only enabled spam checks are used when calculating spam weight. To enable or disable a check, click on the appropriate checkbox next to it and click the Save icon.

The different types of Spam Checks are shown below. In most cases, clicking on the Edit icon will allow you to set various properties about it.

Declude

Declude integration allows you to use Declude products in conjunction with the SmarterMail weighting system. Declude addresses the major threats facing networks, and are handled by a multi-layered defense. Configuration of Declude is done through the Declude product, and all you need to do in SmarterMail is enable the spam check. Declude score will be included on spam line. Declude is a 3rd party open source and more information can be found at: www.declude.com.

SpamAssassin

SpamAssassin is a powerful, 3rd party open source mail filter used to identify spam. It utilizes a wide array of tools to identify and report spam. More information about SpamAssassin can be found at: spamassassin.apache.org.

SmarterMail includes a Windows version of SpamAssassin out of the box. By default, SmarterMail will run a version of SpamAssassin on 127.0.0.1 port 783. The System Administrator can enable and disable SpamAssassin by clicking the Security button on the main toolbar, then selecting SpamAssassin Servers from the Email Protection folder tree view. The Windows Version of SpamAssassin is limited to about 40,000 messages per day, if you anticipate more than this you may require the use of a distributed, multi-threaded version. Additional information is available in the SmarterTools SpamAssassin Deployment Guide.

SmarterMail can use SpamAssassin with its weighting system. By default SpamAssassin will run on 127.0.0.1:783. Additional servers can be setup from the Security->SpamAssassin menu option.

Low Probability of Spam - The weight that will be assigned if SpamAssassin determines a low probability of spam.

Medium Probability of Spam - The weight that will be assigned if SpamAssassin determines a medium probability of spam.

High Probability of Spam - The weight that will be assigned if SpamAssassin determines a high probability of spam.

Timeout - The timeout that SmarterMail will impose on a server if it cannot connect.

Maximum Attempts per Message - This will designate how many times SmarterMail will attempt to acquire a SpamAssasasin score before it gives up on that email.

Custom Headers

Email can be assigned spam weight based on headers in the message. Use this selection to configure weights for custom headers.

Header - The custom header to search for in the e-mail message.

Value - The value of the custom header.

Weight - The amount to add to the e-mail message's spam weight.

Bayesian Filtering

Bayesian Filtering uses statistical analysis to identify whether or not an email appears to be spam. Bayesian Filtering "learns" from previous spam-marked messages to progressively improve performance. Tying it together with blacklists and SPF allows you to be quite sure that email is or is not spam.

Weight - The default weight for this spam check. If an email has a high probability of being spam based on its content, this is the value that will be added to the message's total spam weight.

Max memory to allocate for filtering - Bayesian Filtering can be memory intensive. As a result, SmarterMail allows you to configure the maximum resources that will be dedicated to Bayesian Filtering. In general, the more memory you reserve for Bayesian Filtering, the more accurate the results will be.

Messages required for filter update - Once this number of messages have been processed as known-good or known-spam email, SmarterMail will re-analyze the filters to help your system protect against new spam threats. In this way, Bayesian Filtering can become more tailored to handle the mail of the domains on the server.

DomainKeys

DomainKeys is an e-mail authentication system designed to verify the DNS domain of an e-mail sender and the message integrity. The DomainKeys specification has adopted aspects of Identified Internet Mail to create an enhanced protocol called DomainKeys Identified Mail (DKIM).

SPF (Sender Policy Framework)

SPF is a method of verifying that the sender of an email message went through the appropriate email server when sending. As more and more companies add SPF information to their domain DNS records, this check will prevent spoofing at an increasing rate.

Pass - Indicates that the email was sent from the server specified by the SPF record (more likely good mail). The weight you set may be 0 (for no effect) or a negative number, thereby reducing the spam rating.

Fail - Indicates that the email was sent from a server prohibited by the SPF record (highly likely spam). Set this to a relatively high weight, as the probablility that the email was spoofed is very high.

SoftFail - Indicates that the email was sent by a server that is questionable in the SPF record. This should either be set to 0 or a low spam weight.

Neutral - Indicates that the SPF record makes no statement for or against the server that sent the email. Except in very special circumstances, leave this set to 0.

PermError - Indicates that there is a syntax error in the SPF record. Since SPF is relatively new, some domains have published improperly formatted SPF records. It is recommended that you leave this at 0 until SPF becomes more widely adopted.

None - Indicates that the domain has no published SPF record. Since SPF is relatively new, many legitimate domains do not have SPF records. It is recommended that you leave this at 0 until SPF becomes more widely adopted.

Reverse DNS (Domain Name Sever)

Reverse DNS checks to make sure that the IP address used to send the email has a friendly name associated with it.

Weight - The default weight for this spam check. If an email sender does not have a reverse DNS entry, this is the value that will be added to the message's total spam weight.

RBL Lists (Real-Time Blacklists)

RBL Lists (also known as IP4R Lists) are publicly accessible lists of known spammer IP addresses. These lists can be a very important part of spam protection. To attach to a list, click on the Add List icon. Some common RBL lists are shown at the bottom of this topic.

Name - A friendly name for the list that will help you and your customers identify it.

Weight - The default weight for this spam check. If an email sender is listed with the spam list, this is the value that will be added to the message's total spam weight.

DNS Server - Spam lists operate through DNS. As a result, each list provider gives out a DNS server that contains the blacklist. Enter it in this box.

Description - This field allows you to store additional information about the list.


Filtering

Emails are filtered into one of four categories based on their total weight. If a weight is equal to or higher than a certain category, then it is assigned that probability of being spam. Use the Actions tab to define the weight thresholds and the default actions at each level.

Weight Threshold - The email is sorted into probability levels based on the weight threshold values.

Action - The action to take when a message ends up with this probability.

Text to Add - This is the text that will be displayed when a message reaches a particular level of spam.


SMTP Blocking

This tab allows you to set up extra spam checks that block emails at delivery if a certain amount of spam checks fail.

Incoming Weight Threshold - Enable this and an incoming email must score this value or higher in order to be blocked. The score is established by the settings on the Spam Checks tab. (Default is 30)

Outgoing Weight Threshold - Enable this and an outgoing email must score this value or higher in order to be blocked. The score is established by the settings on the Spam Checks tab. (Default is 30)


Options

Auto Responders - Allows you to restrict what types of auto-responses are permitted for the system. Certain anti-spam organizations are starting to block those servers that auto-respond to spam traps. To reduce the possibility of this occurring, set the auto-respond option to be as restrictive as your clients will permit.

Content Filter Bouncing - As with auto-responses, certain anti-spam organizations also blacklist those servers that send bounce messages back to spam trap accounts. SmarterTools recommends setting this option to be as restrictive as your clients will allow.

Enable domains to override filter weights and actions - Many domain administrators have their own opinions on what spam checks work best for their domain. Enable this to allow them to override the spam options if they wish.

Enable bounces for Outgoing SMTP Blocking - Enable this to give a user a notification when a mail message has not been sent due to spam.

Enable Spool Proc Folder - Enable this to have SmarterMail place messages into this folder to be analyzed in the background. While the messages are in the Spool Proc folder, .hdr can manipulate elements of the message, such as edit, write, and add headers. Once the scan has been completed, the message will be placed back into the spool and handled by SmarterMail from that point on.

Disable spam filtering on intra-domain email - Check this to disable spam filtering when messages are sent from from within the same domain (e.g. user1@example.com to user2@example.com).

Disable spam filtering on SMTP whitelisted IP Addresses - Check this to disable spam filtering on IP Addresses which have been added to a whitelist.

Enable Catch-All accounts to send auto-responders and bounce messages - Enable this if you rely on auto-responders being sent when a message comes in through a catch-all. In general, this is a bad idea, so it should be left unchecked unless your situation specifically requires it.

Bypass Gateways

This tab gives administrators the ability to enter an IP Address or an IP Range of an incoming gateway. SmarterMail will analyze the .EML file and pull the most recent IP Address from the header which will usually be an organizations incoming gateway. By inputting that IP Address on this page will allow SmarterMail to analyze the IP of the originating server rather than focusing on the gateway that SmarterMail received the message from. This is important because the majority of the time an organizations incoming gateway will not be listed on any RBL lists, but the originating server may be.

To add an IP Address or IP Range, click the Add IP icon from the Actions toolbar.