The 20 Minute E-mail Solution!
TOC PREV NEXT INDEX

Advanced Configuration

Once you have configured the basic antispam features, you may want to use the advanced features to further enhance spam detection. Advanced statistical filtering options let you control the actual antispam engine, while delivery rules allow you to use more options in processing spam.

Advanced Statistical Filtering

The options presented here control the underlying functionality of the statistical filtering component, and are dependant on each other to effectively identify spam. If you have a significant number of legitimate messages that are being identified as spam (false positives) or vice versa, you may need to adjust these options.
Note: The default settings are appropriate for most systems. It is strongly advised that ONLY experienced administrators modify these settings. Setting these options too high or too low will hinder the effectiveness of IMail Server to identify spam.

Getting to the Advanced Statistical Filtering Settings:

  1. In the left panel, expand the localhost folder, and select a host with an IP address.
  2. Expand the host, and select the Antispam folder.
  3. In the right panel, select the Content Filtering tab, and click Advanced. The Advanced Statistical Filtering dialog box appears as shown below.

Options

The Probability a new word is spam. The percentage assigned to new words to determine if they are spam. Enter any value between 0 and 100%, the default being 40%.

The higher the value, the more likely a new word will be treated as if it had appeared in spam email. The lower the value, the more likely a new word will be treated as if it had appeared in non-spam email. For example, if you enter 0, every new word will be treated as non-spam. If you enter 100%, every new word will be identified as spam.

It is recommended that this value not be set higher than 40% in order to bias the statistical analysis in favor of being legitimate email, thereby, reducing the likelihood of false positives.

An email is spam when its calculated probability exceeds. This option sets the minimum probability percentage at which a message will be identified as spam. Messages with probability values below the value entered here, are identified as non-spam. Messages with probability values above this value are identified as spam.

Enter a value between 0 and 100%, the default being 90%. The closer the value is to 100%, the less likely that any messages will be identified as spam. The closer the value is to 0, the greater the probability that you will have false positives.

Maximum Number of words to use in calculating an email's probability. The number of individual word values, within each email, used to calculate the probability that an email is spam. Enter a value between 10 and 25 the default being 15.

Using Delivery Rules to Filter Spam

Delivery rules are useful tools in filtering spam because they offer more options for processing messages. On the antispam tabs, if a message is identified as spam, you can delete it, forward it to an address, or insert an X-Header. By using delivery rules to process the message, you can choose from: delete, forward, move to mailbox, copy or bounce. Delivery rules can be set up at the host and user levels.

If a message matches any of the black lists or fails a validation test, a spam X-Header is inserted into the message header. In addition, phrase filtering and statistical filtering can also be configured to insert X-Headers. If you want to catch such a message, set up a rule to search for one of the spam X-Headers. If a message is trapped by a delivery rule, it is processed according to the action specified in the rule.

Filtering Spam Messages from a Black List for a Specific Reason

Suppose you want to accept all messages whose IP addresses are listed in the FIVETEN black list because they are dialups.

  1. Set up a delivery rule at either the host or user level that will search for all messages that contain the following X-Header:
X-IMAIL-SPAM-DNSBL: (FIVETEN, +\d, 127.0.0.3)
  1. The rule looks like this in the Rules dialog box:
Header Contains X-IMAIL-SPAM-DNSBL: (FIVETEN, +\d,127.0.0.3)
  1. Choose one of the following rule actions: forward, move to mailbox, or copy. For example, select Move to Mailbox and in the Address text box enter "Spam".

This rule searches for all messages whose IP addresses are in the FIVETEN black list because they are dialups and sends them to a mailbox called "Spam"
Note: The above rule looks like this in the rules.ima file: H~ X-IMAIL-SPAM-DNSBL:(FIVETEN):Spam
.

Tip: You may want to select the Insert X-Header option and set up a mailbox specifically for spam, so that you can evaluate the messages that are trapped to ensure that no legitimate mail gets caught by mistake

Bouncing Spam Messages

To bounce a message that is identified as spam back to the sender, you must set up a delivery rule at the host level. Before you set up a rule, determine the reason you want to bounce spam messages and identify the corresponding X-IMAIL-SPAM header that is inserted into these types of messages (i.e. X-IMAIL-SPAM-DNSBL). If you want to bounce all spam messages regardless of the reason it was identified as spam, you will need to create a rule or rules that search for the generic X-IMAIL-SPAM header. For a list of all spam X-Headers see "X-Header Explanations".
Note: We do not recommend that you bounce messages. Bouncing messages could cause messages sent from your email address to be tagged as spam.

Example

This example assumes that you want to bounce all messages that are identified as spam. To bounce a message that is identified as spam, complete the following steps:

  1. Make sure that all of the antispam features are set up to insert X-Headers.
    • On the Connection Filtering tab, black lists should be listed only in the top list box.
    • On the Content Filtering tab, the spam action for both statistical filtering and phrase filtering should be set to Insert X-Header.
  2. Click on the host's Inbound Rules tab, and click Add.
  3. Enter the following parameters for the rule:
If the Header Text
Contains
X-IMAIL-SPAM
  1. Click Add Condition, then click OK.
  2. On the Inbound Rules tab, select the rule you just added and select Bounce.
  3. Click Apply to save your changes.

For more information on configuring delivery rules, see "Creating an Inbound Delivery Rule".

Forward Spam messages to a Specific User Folder

You can allow your users to manage their own spam, by directing all messages that are identified as spam into a folder for the user account. The user can then delete the ones that are spam, notify you of any false positives, or set up a forward file that will move specific messages into their Inbox. To create a rule that moves spam into a specific sub mailbox, complete the following steps:

  1. Make sure that all of the antispam features are set up to insert X-Headers.
    • On the Connection Filtering tab, black lists should be listed only in the top list box.
    • On the Content Filtering tab, the spam action for both statistical filtering and phrase filtering should be set to Insert X-Header.
  2. Click on the user's Inbound Rules tab, and click Add.
  3. Enter the following parameters for the rule:
If the Header Text
Contains
X-IMAIL-SPAM
  1. On the Inbound Rules tab, select the rule you just added and Select Move to Mailbox. Then, in the Address box, enter the mailbox name to which you want messages sent to, for example "Spam".
  2. Click Apply to save your changes.

Ipswitch, Inc.
http://www.ipswitch.com
TOC PREV NEXT INDEX
©Ipswitch 2005