How we detect Spam and Viruses

How does the filter determine which messages are spam?

We employ an extensive range of tests on incoming messages to detect spam. These include traditional, widely used approaches for spam detection such as message authenticity checks, header analysis, message signature analysis, databases of domain names and addresses used by spammers, and whitelists and blacklists. We have also developed advanced, industry-leading techniques such as real-time message source analysis, graphics analysis, and user-based message profiling.

What percentage of junk email does the filter catch?

The detection rate varies dependent on the email traffic patterns for a given domain, and on the spam filter aggressiveness setting, since customers can configure how aggressive they want the filter to be. On average, we block over 98% of junk email and 100% of email-borne viruses.

What happens to messages that are detected as spam?

You have several options for handling detected spam messages:

1. The first option is to simply drop the message. Be advised that, with this option enabled, any message detected as spam will be discarded, with no chance of recovering the message. As a result, we do not recommend selecting this option, particularly at the inception of the service.
2. The second option is to modify the subject line of messages that are detected as spam, and forward them to your email account. The spam filter will add the phrase **SPAM** to the beginning of the subject line for detected spam messages. If you select this option, you can benefit from setting your email client to place messages with **SPAM** in the subject line directly into your Junk Mail folder.
3. The third option is to redirect all the junk mail to a single email address at your domain, i.e. [e-mail]. This allows for administrator-level review.
4. The fourth option is to redirect junk mail to an individual, password-protected junk mail quarantine. The quarantine is hosted at this control panel and can be reviewed at any time. This is the recommended spam-handling option.

These handling settings can be configured on a per-user basis, or across a given domain or organization.
 

How do I change the aggressiveness of the spam filter?

The control panel allows you to customize the spam filter to suit your needs. There are six aggressiveness levels:

1. Very High - an extremely aggressive setting in which almost all spam (in most cases in the neighborhood of 99%) is detected; however, false positives are likely to result unless whitelists are used widely.
2. High - a common setting by which a high percentage of spam (typically about 98%) is detected. False positives may occur on occasion with certain types of emails - for example, messages sent via compromised (open relay) mail servers, marketing communications that are very aggressive in tone, and other mail that includes "spam-like" elements. Given the ease of whitelisting these sources, this relatively aggressive posture can allow for a very low number of false positives while continuing to detect a very high percentage of spam.
3. Medium - typically between 96% and 98% of spam is detected. False positives are very rare.
4. Low - a non-aggressive setting in which typically between 94% and 95% of spam is detected, with almost no chance of any false positives.
5. Very Low - this setting is typically used only by individuals who receive a significant number of highly suspect emails. This setting is generally not recommended.
6. Unfiltered - messages will not be detected or handled as spam.

Like the handling settings, this aggressiveness setting can be configured on a per-user basis, or across a given domain or organization.

Why am I receiving a large number of bounce messages?
 

This happens when a spammer has forged your address as the "From" address in a spam run. When those spam messages are sent to invalid addresses, the receiving server will generate a bounce message, and that message will go back to you instead of to the spammer.  This is known as backscatter and has become a more frequent occurrence over the last couple of years.

Unfortunately, there is no way to stop a spammer from forging an address as the supposed "From" address of a message. It is also sometimes difficult for a spam filter to distinguish between a bounce message is generated under these circumstances, and a bounce message generated for a good reason (i.e. somebody attempted to send a legitimate message but made a typo in the "To" address).

The spam filter has a feature by which all bounce messages can be treated as junk mail. This can be enabled in the event that a customer is receiving a very large number of bounce back messages, and then disabled a couple of days later after the spam run and resulting bounce messages have subsided.