Email Protection spam content filtering controls spam by comparing the content (subject and body) of an email against predefined lists of keywords or phrases (spam content groups).
You can define a custom spam content group that contains additional lists of keywords that are used to filter email as spam. For each content group, you also define the action to take on email that contains a keyword. If the action is to send spam matches to quarantine, users who receive Spam Quarantine Reports can view the matching messages in the quarantine.
Note: A spam content group does not analyze the content within attachments.
If a Message is Probably Spam (Medium likelihood) area
Select an action Email Protection should take if an email has a spam score of 90% or higher:
• Tag the message subject with “[SPAM]” – Email Protection adds the phrase “[SPAM]” to the beginning of the email’s subject text and sends the email to the recipient.
• Quarantine the message – Email Protection sends the email to quarantine.
• Deny delivery – Email Protection denies delivery of the email.
Note: Emails that have the following actions applied will be reported as Other in the Threats: Spam report.
• Do nothing – Email Protection sends the email to the recipient with no filtering or notification.
If a Message is Probably Spam (High likelihood) area
Select an action Email Protection should take if an email has a spam score of 99.9% or higher. These actions are the same as those for Medium likelihood.
Configure a Spam Filter Email Protection Administrator Guide
The action for a content group you define overrides spam actions for Email Protection default spam filters. For example, if Email Protection determines that an email has a medium likelihood of being spam and also contains a keyword that is in your spam content group, the action defined for your spam content group is applied.
However, if you also define content filtering on the Content – Content Groups window (see Configure a Content Filter, that content filter overrides the keyword filtering you define on the following Spam – Content Groups window. In addition, spam identified by the Content – Content Groups filter is accessible only by Quarantine Managers or higher level administrators. Users cannot view this spam.
1 Click Email Protection | Policies.
2 Select the policy you want to change.
3 Click the Spam.
4 Click Content Groups.
5 Double-click the Content Group you wish to modify.
6 In the Group Name field, type the name of your spam content group.
This name should summarize the kind of keywords you want Email Protection to look for. For example, you might want to identify musical terms, such as concert, music, rock, jazz, and so on, as spam. In this case, your group name might be music.
7 From the Action drop-down menu, select an action to take if an email matches a keyword:
• None – The email is forwarded to the recipient email address.
• Quarantine the message – The email is sent to the recipient's domain content
Email Protection Administrator Guide Configure a Spam Filter
Note: Emails that match keywords but are allowed will be reported as Other in the Threats: Spam report.
• Tag the message subject with "[SPAM]"– The phrase "[SPAM]" is added to the subject line of the email at the beginning of the subject text and the email is sent to the recipient email address.
• Encrypt Message– is also available for Outbound content groups, if the Customer has subscribed to Encryption.
• Silent Copy – allows you to forward a copy of the original message. To send a copy, select a predefined distribution list from the drop-down.
8 Content List the content keywords needed to define your Custome Content Group.In the Content field, type any keywords you want to search for in email. Use the following rules for entering keywords.
• Each entry must be on its own line (separated by a hard return).
• If an entry contains multiple words, the entire phrase is used as a literal string (as is).
• If individual words are desired, each word must be on its own line.
• Letter-case (for example, upper case or lower case) is ignored.
• The wildcards question mark (?) and asterisk (*) can be used to designate the following:
— ? – designates any single character, including white space characters (for example, menu, space, line break, etc.).
— For example, w?y would catch way, why, and w y.
— * – at the end of the string designates multiple characters until a white space character is encountered.
For example, refi* would catch refinance, refinancing and refine.
— * – followed by a literal character designates multiple characters, including white space characters, until the designated character is encountered.
For example, refi*d would catch refinanced, but would also catch refinishing is a great way to save d.
— If the literal asterisk or question mark is desired, it must be preceded by a backslash (for example, \* or \?).
9 For example, why\? (without quotes) would catch the string why? and the question mark would not be used as a wildcard.Click the Enable checkbox to turn on the spam content group.
10 Click Save for the new spam content group.
11 Click Save for the policy or continue to the Reporting tab.
To change a policy’s existing spam content group, click Edit.
Configure a Spam Filter Email Protection Administrator Guide