* note - you should always check your admin@ mailbox regularly as any system messages e.g. 'mailbox full' will be sent to this address.

Spam filter configuration

Our e-mail server software offers comprehensive and customisable spam filtering which works by allocating incoming e-mail a 'score' using a number of different techniques and by the domain owner or user setting the action to be taken based on this score.

The techniques used when analysing incoming e-mail are as follows :

Reverse DNS check

Our mail server checks to see if the connecting server has a valid reverse IP address. This is important as any 'real' internet mail server should always have a valid reverse IP address whereas mail sent through a home machine connected via an ISP would not - this protects against compromised private computers being used as spam broadcasters.

If the reverse DNS lookup fails then then a header is added to the e-mail noting this.

Public spam database lookup

For each mail received the mail server also does a lookup on the sending mail server IP address and checks it against three public spammer databases - Spamcop, Spamhaus and DSBL - a match against one of these databases indicates that the sending mail server has previously been reported as a sender of spam.

As with the reverse DNS check, for each match that is found an additional header is added to the e-mail noting this.

Bayesian filtering

This is a system whereby the mail server 'learns' the patterns of potential spam based on the content, scoring and user actions of previous mail received. Over time this can build up a very useful and accurate measurement of whether a particular mail received is likely to be spam.

Again, if the filtering system identifies an incoming mail as likely spam an additional header is added to the e-mail noting this.

Scoring e-mail for Spam

Once incoming e-mails have been through this set of filters if they have one or more of the extra headers attached the system then assigns a score to the e-mail as follows :

Reverse DNS lookup failure = 5 points
Spam database lookup match = 10 points per match
Bayesian Filtering failure = 10 points

So any individual e-mail may score between 0 points if completely clean and 65 points if it fails all tests.

Taking actions based on the e-mail score

Actions can be taken on e-mails depending on the score they have achieved and these actions can be set at server, domain or individual mailbox levels. By default the server will only take the following actions :

Score of 0 = No action
Score of 5 = Add text to e-mail subject line 'SPAM-LOW:'
Score of 15 = Add text to e-mail subject line 'SPAM-MED:'
Score of 25 = Add text to e-mail subject line 'SPAM-HIGH:'

Obviously just marking the incoming mails as spam does little to stop the problem so you would want to be a little more aggressive in your own settings. You can modify the settings at domain or individual mailbox level to suit your individual needs - options are to mark e-mails as spam in the subject, send them to a junk mail folder or to delete them entirely.

You can find the spam settings page by logging into the mail server via webmail and clicking on the 'settings' link - if logged in as an individual user you can change the settings for your own mailbox, if logged in as a domain admin you can make domain wide changes.

As an example this is how we have the settings for our own DotNetted domain and the reasons for implementing them this way :

Score of 5 = Add text to e-mail subject line 'SPAM-LOW:'

If any e-mail scores 5 or 10 then we like to know about it, and for it to be analysed by the bayesian filter engine to help the system 'learn'.

Score of 15 = Add text to e-mail subject line 'SPAM-MEDIUM:'

If an e-mail scored 15 or 20 then it failed two of the filtering tests and there's a 90% probability that it is spam. At the moment on our own mailboxes we just mark this spam as such and still receive it but as of the time of writing this filter is working well with zero false MEDIUM positives out of hundreds received so we will shortly be switching this to automatically delete.

Score of 35 = Delete e-mail

If an e-mail scores 35 or more then it has failed at least 4 of the filtering tests and can confidently be assumed to be spam. In this case we just delete the e-mail outright without viewing.

Content Filtering

In addition to the automated spam filtering our mail software also includes content filtering which again is set by logging into webmail as a user to set filters for a single mailbox or as a domain admin to set filtering across a domain.

Content filtering allows you to take action on incoming e-mails by matching filters that you create yourself, for instance you can create a filter that will check through the e-mail body for the word 'viagra' and delete or move any mails found to match. The options available are extensive and you can filter by mail content, sender, recipient, attachment and other.

Success rates

Through a combination of spam filtering and content filtering it is possibly to drastically reduce the amount of spam that makes it to your inbox, for our own domains we estimate that we're stopping around 80 - 90% of spam before it reaches our mailboxes.

More Information

For complete information on spam and content filtering please use online help built into the mail software - when logged in to your account via webmail click on the help icon at the top right.