TechTip #40: Controlling the new Spam filter

Note: TechTips can also be downloaded from the SEBTS intranet (as PDF files) – see http://intranet/Management/TechTips/ .

Click for Print Version (Best printing results are obtained by using these PDF files, rather than printing the note from Outlook). [If not formatted correctly in Webmail – Internet Explorer: Turn off reading pane Firefox: click “View As Web Page” link at top]. IT at Southeastern recently replaced the previous spam filter with a new one – the Barracuda Spam Firewall

This TechTip explains how the filtering works and how you can control it to get better results (less spam and fewer quarantines of good emails).

Background: Spam filter flow chart:

TechTip #40:

Email –

Controlling the new Spam filter

Explanation for flow chart at left (top to bottom):

• Email that has already been checked for viruses and

potentially harmful attachments enters the spam filter.

• Emails with senders or domains found on your Blacklist are

blocked. Those found on your Whitelist are sent to your

inbox.

• Remaining emails go through the Spam Filter, which gives

each a score, based on known spam and your classifications:

- High-scoring emails are almost certainly spam and are not

passed on to you.

- Medium-scoring emails are possibly spam and are placed in

Quarantine – a “Spam Quarantine Summary” email is sent to

you.

- Low-scoring emails are probably not spam and are sent to

your inbox.

• You have controls in the Spam Quarantine Summary email to

Deliver, Whitelist or Delete the quarantined emails.

• By clicking the link in the email to go to the “quarantine

inbox”, you get additional controls for Blacklist, “Classify as

Spam” and “Classify as Not Spam”.

• Quarantined emails will remain at least 14 days if you do not

take any action on them. After that, they are deleted.

• When you use the controls “Classify as Spam” and “Classify

as Not Spam”, the spam filter adjusts future scoring.

Use this page to understand the big picture.

(Details for the controls you have are on following pages).

“Spam Quarantine Summary” Email

Message gets low score or user clicks Deliver Email that has

passed anti-virus and attachment checks enters here Spam Filter & Quarantine

“Spam Quarantine Summary” Email has controls for Deliver, Whitelist and Delete. - Click “quarantine inbox” link to Blacklist, or Classify (as Spam or Not Spam).

Using the basic controls in the “Spam Quarantine Summary” email:

When the spam filter determines that an email is possibly spam (medium score), it places the email in your quarantine inbox. You are sent a periodic (default is daily) email which shows your quarantined emails. This “Spam Quarantine Summary” email is only sent to you if new emails have been added to the quarantine since the last summary email.

- Here is the format of a Spam Quarantine Summary email:

Basic Controls (done from this summary email):

NOTE: If you want to whitelist this sender, click Whitelist rather than Deliver. Once Deliver is clicked, the email is removed from your quarantine list.

Whitelist: Adds the selected email address to your whitelist, so all future emails from it will not be quarantined, and delivers this email to your inbox.

NOTE: If you want to whitelist the domain (e.g., “hp.com” or “us.newsgram.hp.com”) and not the exact address shown, you must log in to control your whitelist from your Preferences (explained in a following section).

Delete: Removes the selected email from your quarantine list. (The email will be deleted in 14 days anyway, but clicking Delete will enable you to keep track of Emails in your quarantine are listed here.

The “Actions” column has these controls for each email:

Deliver, Whitelist, Delete (See details below).

Using the detailed controls in the “Quarantine Inbox”:

When you need more controls on emails that are in your quarantine, go to your Quarantine Inbox. There are two ways to get there:

Method 1: Log in to your SEBTS Spamfilter account at http://spamfilter.sebts.edu using your normal intranet logon:

Method 2: Click the link at the bottom of your Spam Quarantine Summary email:

Use your normal network username and password

This link will automatically log you in to the SEBTS Spamfilter.

Either method will open a browser window and take you to your Quarantine Inbox:

Select some or all of the emails on your list, and click the button for the appropriate action as shown below:

Detailed Controls (done from your Quarantine Inbox):

Whitelist: Adds the selected email address to your whitelist, so all future emails from it will not be quarantined, and delivers this email to your inbox. Whitelist/Not Spam: Performs the same functions as pressing both the “Whitelist” and “Classify as Not Spam” buttons

Delete: Removes the selected email from your quarantine list. (The email will be deleted in 14 days anyway, but clicking Delete will enable you to keep track of which messages you have yet to review).

Classify as Spam: Modifies the Spam Filter to make it more likely that similar messages will be marked as spam in the future. Classify as Not Spam: Modifies the Spam Filter to make it less likely that similar messages will be marked as spam in the future.

The DeliverWhitelistDelete controls in the “Actions” column to the right of each message perform those functions, but only on the email item on that line.

09/30/08 23:08:18 "Hewlett-Packard" <Hewlett-Pack Lowest Price of the Season on HP Products!

These 6 buttons control all of the email items that are selected (checked).

These 3 “Actions” links control only the email on that line.

Click on an email item in the list to view its text (graphics will not be shown).

Changing your Preferences –

Whitelist/Blacklist

:

The Preference tab allows you to modify your Whitelist and Blacklist, adjust the frequency of the Spam Quarantine Summary emails, and view filter statistics. While logged in to your Quarantine Inbox, click the “Preferences” tab. You will see your “Whitelist/Blacklist” controls:

From your Quarantine Inbox, click the “Preferences” tab to view your

“Whitelist/Blacklist” controls.

You will see any email addresses added when you previously clicked a Whitelist button from your summary email or Quarantine Inbox.

Manually Modifying Your Whitelist and Blacklist:

You can use the Whitelist/Blacklist controls to manually add and remove email addresses or domains. In the example below, we will modify the Blacklist (the same method is used for changing the Whitelist with its control). There are two methods for this:

Method 1 – Add one email / domain at a time:

Method 2 – Bulk Edit:

Manually editing your Blacklist:

- Method 1 – Add one address at a time:

Type the address or domain into the Email Address field of the Blacklist control and click the “Add” button. Use the trash can icons to delete entries.

- Method 2 – Bulk Edit:

- Click the “Bulk Edit” button

- Add email addresses or domains to the list that pops up - Click the “Save Changes” button

To delete any entries, select them and press the Delete key on your keyboard.

Changing your Preferences –

Quarantine Settings

:

To adjust the frequency of the Spam Quarantine Summary emails, from the “Preferences” window, click the “Quarantine Settings” tab:

Changing your Preferences –

Spam Settings

:

The Spam Settings tab provides information on how many messages you have classified as “Spam” and “Not Spam” (using the controls in your Quarantine Inbox).

It is not recommended that you use any of the Bayesian Database controls on this screen. If you have questions about this, contact the IT Department to discuss it.

From your Quarantine Inbox, click the

“Preferences” tab, then click the “Quarantine Settings” tab.

Use the Notification Interval controls to select Daily or Weekly.

(“Daily” is recommended; Selecting “Never” is not recommended).

Your sebts.edu email address is the default for receiving the quarantine summary notices.

When done, click “Save Changes.”

The “Spam Settings” tab will show you how many messages you have classified as “Spam” and “Not Spam”

The Bayesian Database controls the spam filter based on the emails you classify. You should not need to use any of the database controls on this screen. Contact the IT Department if you have questions about this.

All TechTips are placed online as they are sent out!

[Use these for best printing results]

Go to the IT TechTips page on the Intranet ( http://intranet/Management/TechTips/ ) and download and print any tips you want.

[If not formatted correctly in Webmail – Internet Explorer: Turn off reading pane Firefox: click “View As Web Page” link at top]. Bob Peckham, Special Assistant to the IT Director (x277)

To make comments or suggestions for future TechTip topics, contact [email protected] .

Did you know?