ePrism User Guide - EdgeWave

Email Spam Processing
Email Spam Processing
ePrism applies a series of filters to messages beginning with the simplest and proceeding to the
most complex. The sequence is as follows:
1. Various SMTP connection checks are performed for items such as unauthorized pipelining
commands, non-FQDN senders, unknown sender domains, and so on.
2. The source of the message is compared against a locally specified Specific Access Pattern.
If found, it may be "rejected" or "accepted" for immediate delivery or relay.
3. ePrism will apply locally specified attachment, malformation, and virus checks on the contents
of the message.
4. The message is passed through the OCF (Objectionable Content Filter) which searches for
objectionable text within a message.
5. The message is passed through Pattern Based Message Filters that look for a text or pattern
match against a specified part of the message. If a filter rule is triggered, an associated action is
executed such as "reject" or "accept" for immediate delivery. Any defined Trusted Senders will
allow mail to bypass the rest of the spam controls.
6. Mail is processed for spam only if it arrives from an "untrusted" source. This is defined as any
system not on the local network or not specifically "trusted" by the administrator.
7. The source of the message is checked to see it is listed on an RBL (Real-time Blackhole List), if
enabled. The message may be rejected, quarantined, or tagged and delivered as required.
8. The message is checked by DCC, if enabled, which reports if the message is "bulk" or has been
reported on the Internet a certain number of times to be classified as "bulk". If this value
exceeds the local threshold, the message may be rejected, quarantined, or tagged and delivered
as required.
9. The message is checked by STA, if enabled, to see if its contents exceed a locally specified
threshold for spam. If so, the message may be rejected, quarantined, or tagged and delivered as
required.
10. Prior to delivery, ePrism will check to see if this message was relayed.
See “Message Processing Order” on page 271 for a summary of the message processing order.
99