User manual

Criterion Description
enter a threshold value here. Example: Minimum
number = 2 means that all messages with two or
more file attachments are delivered without spam
checking.
Emails with minimum size of Spam e-mails are generally small, and large
e-mails are therefore unlikely to be spam. Here,
you can enter a size above which message are no
longer checked for spam.
Emails in TNEF format TNEF E-Mails. This Exchange-specific format is
not being used by spammers yet.
Emails encrypted and/ or signed Encrypted and/or signed e-mails. Spammers do
not send encrypted or signed e-mails.
Microsoft Exchange "No spam" SCL value
Also refer to Write spam result in Exchange SCL
field .
Spam confidence level (SCL), spam filter
(intelligent message filter – IMF) from Exchange
2003. SCL accepts integers from -1 to 9. Exchange
assigns -1 for e-mails from senders from the same
Exchange organization. The Wall Spam Filtering
job treats this value as definite “no spam” criterion.
5.4.2 Definite Spam Criteria
Criterion Description
E-mails from the following
senders (Blacklist)
Blacklist: All sender addresses known to be originators of spam. The
default configuration contains a list of known addresses to which you
can add further addresses.
Emails with this character set This function checks the charset field in the message header for the
character sets in the specified list. Messages with a matching character
set are immediately classified as spam.
Exchange SenderID request
returns "FAIL"
For details on SenderID refer
to http://www.microsoft.com/
mscorp/safety/technologies/
senderid/default.mspx
If enabled, the mail's sender ID is also checked. This allows to prevent
"spoofing", i.e. the falsification of sender mail address domains. The
analysis is based on entries in a DNS, which is used to determine from
which iP addresses e-mails from specific domains are allowed to be
sent or not. The Sender ID result is provided with the mail. Wall checks
the mail's Sender ID and classifies the result "FAIL" as spam. To be
able to use the SenderID function, a number of other functions need to
be enabled at the server, such as the associated SenderID filter. The
filter is enabled under Server - Protocols - SMTP - Properties in the
Identification field. In addition, both server and client (Outlook) must be
configured.
Tip: If you want e-mails deleted immediately only if they are definitely spam, set the
spam probability for High to 100 and define an appropriate action. This ensures
that only e-mails definitely identified as spam (i.e. using the blacklist or character
set) fall into this range. If you set this range, for instance, to 91 to 100, e-mails with
a high spam probability based on other criteria will also be placed into this category.
5.4.3 Practical Tips
Depending on your working environment, the job may sometimes classify normal and
wanted mail as spam. If that happens, try the following configuration settings:
Avira AntiVir Exchange 7
132