Help & Frequently Asked Questions Help & Frequently Asked Questions

Help & FAQ Home  |  Most Common Questions  |  Browse by Category  |  Search Entries

Search FAQs
Keywords: FAQ ID:

Question/Problem Question/Problem
  How does Smarsh spam filtering work?
Answer/Resolution Answer/Resolution
  Technical details of Smarsh spam filtering technology

Smarsh offers a state-of-the-art industry-standard spam filtering solution to all customers.  In most cases, users can simply enjoy the benefits of not seeing a lot of spam without any action or configuration needed on their part.  This document outlines the technical details behind exactly how our spam filtering systems work.

Phase One: RBL Check
When a message comes in, the first thing our spam filtering system does is look at the IP address of the server that sent it, and compare that against a list of known spam sources.  Any message coming from a known spammer gets immediately rejected.  This list (called an RBL, or Realtime Blackhole List)  is automatically updated several times every day.

In the unlikely event that a legitimate sender ends up on the RBL, they'll receive a bounce message saying their message was rejected.  The most common reason this might happen is if someone on their network has a computer infected with a virus which is sending out spam.  If this happens, the first thing they'll need to do is find the source of the problem and make sure there is no longer any spam coming from their network.

Phase Two: Virus Scanning
Every message is scanned for viruses, and any message containing a virus is automatically deleted.

Phase Three: Content Analysis
Once the message has gotten past the RBL check and has been determined to be virus-free, the message content is analyzed to determine how likely it is that the message is spam.  Each message is assigned a numeric score, where the higher the score, the more likely it is that the message is spam.  This is based on a wide variety of criteria, and these criteria are also frequently updated.

Messages with a low score are sent straight to your Inbox.  Messages with a very high score are silently dropped, with no notification to you or the sender (these should be 100% spam, and the sender's address is likely to be forged, so sending a notification to the "sender" would really just be sending an error message to an innocent victim).  Anything in between is considered "questionable", and will be tagged with "[BULK]" in the subject line before being delivered to your Inbox.

We recommend setting up a rule in your email client (e.g. Microsoft Outlook, or our webmail system) which will automatically move tagged messages into a Junk folder which you can set up yourself.  This way, any messages that our system thinks might be possible spam will not clutter up your Inbox, but if you suspect you may be missing something, you always have instant access to these messages.

Optional Quarantine
If you prefer, we can set up our spam filter to quarantine questionable messages, instead of tagging them.  In this case, these messages are intercepted and held on our spam filter, and once per day you will be sent a notification if any messages are waiting.  Follow the link in the notification message to view your quarantined messages.  If any legitimate messages were quarantined, you can choose to deliver them to your Inbox.

If you find that you are receiving too much spam in your Inbox, we can reduce the Tag or Quarantine threshold, so that lower-scoring messages will be tagged or quarantined.  The risk is that some legitimate messages could be tagged as well, so you might not see them right away.

If you find that legitimate messages are being tagged or quarantined, we can increase the threshold, so that questionable messages will be delivered to your Inbox.  The risk is that some spam will also be delivered to your Inbox.

If you suspect that legitimate messages are not getting through at all, we can increase your Block threshold.  However, our default settings are already high enough that it's very unusual for any legitimate message to be blocked for this reason.

If you have any further questions about our spam filtering technology works, please contact our technical support team.  We'll be happy to help!

Keywords : barracuda cuda spam2 spam3 spam4 spam5 spam6 filter firewall
Category : Spam Filtering
FAQ ID : 274
Last Updated : 3/4/2016