Hosted Exchange: Spam Filter Policies

Note: This help article applies only to Hosted Exchange. If you are not sure which email service you use, you can find further information in the following article.

https://www.green.ch/en/which-email-service-do-i-use

The spam filter policies in EdgePilot determine how an email is handled when a security or spam check is triggered. For example, the policies define whether a message is delivered, tagged, moved to quarantine, forwarded or deleted.

A single tag does not automatically mean that a message is spam. The spam filter collects various technical indicators and evaluates them together. Several tags may therefore appear on the same message at the same time.

Difference Between Tags and Spam Filter Policies

Tags indicate which checks were triggered for an email. Examples include BULKMAILER, DMARC, PHISHING, WEBBUG and WEIGHT20.

The spam filter policies determine which action is performed when such a tag is detected. Depending on the policy, the same check may, for example, only trigger a warning or cause the message to be moved to quarantine.

Available Actions

Warn

The email is delivered but receives a spam warning or corresponding score. This action can be used for characteristics that do not by themselves prove that a message is spam.

Hold

The email is held and moved to quarantine. An administrator can review the message there and release it if necessary.

You can find the quarantine in EdgePilot under Email Threat Protection and Quarantine.

Delete

The email is discarded. This setting is particularly restrictive. A message that has been incorrectly classified and deleted cannot subsequently be released from quarantine.

Tag Header

An additional entry is added to the message header. Such entries can, for example, be evaluated by Outlook rules or downstream mail gateways.

Examples of possible header entries include:

X-Spam-Status: Yes
X-Spam-Score: 12

Tag Subject

The subject of the email is supplemented. For example, the subject August Invoice can become [SPAM] August Invoice.

Forward

The email is forwarded to a defined address. This action can, for example, be used for a security, abuse or monitoring mailbox.

How a Policy Handles a Message

Each rule can be enabled or disabled and assigned its own action.

For example, if the Warn action is used for the PHISHING tag, the message is delivered and the PHISHING tag remains visible in the log.

If the Hold action is used for PHISHING, the message is moved to quarantine. If the Delete action is used, it is discarded.

Note: Only change policies after you have checked the tags of the affected message. A less strict setting may result in more unwanted or dangerous messages being delivered.

Weighting Checks

The WEIGHT10, WEIGHT15, WEIGHT20 and WEIGHT30 tags refer to the overall score of a message. Other checks provide indicators or score points. When a defined weighting level is reached, the corresponding WEIGHT tag is triggered.

WEIGHT10: very aggressive spam filtering
WEIGHT15: more aggressive spam filtering
WEIGHT20: standard spam filtering
WEIGHT30: almost certainly spam

In the documented configuration, WEIGHT20 and WEIGHT30 are set to Hold. If a message reaches the corresponding score, it is moved to quarantine.

In cases of incorrect classification, internal documentation has sometimes recommended disabling WEIGHT10 and WEIGHT15 because these levels filter much more aggressively.

Phishing and Fraud Checks

PHISHING: general phishing characteristics
PHISHURL: known phishing URL detected
SPEARPHISH: characteristics of a targeted phishing attack
419SCAM: characteristics of an advance-fee scam
INVESTMENT: typical terms associated with investment fraud
PHISHPHINDER: phishing detection

These tags indicate characteristics that may occur in connection with phishing or fraud. The effect of a tag depends on the policy defined for it.

Tags for Marketing and Newsletter Emails

BULKMAILER: bulk mailing detected
OPTOUT: unsubscribe link present
WEBBUG: tracking pixel detected
COMMENTS: hidden HTML comments detected
FINGERPRINT: match with a detected message pattern

Legitimate newsletters can also receive the WEBBUG, OPTOUT and BULKMAILER tags. These characteristics alone do not prove that a message is spam. However, together with other checks, they can increase the overall score.

Tags for Obfuscation Techniques

SPACEDSUBJECT: deliberate word separation in the subject
ENCODEDSUBJECT: RFC-encoded subject
BASE64TEXT: Base64-encoded text
BADCHARSET: suspicious character set
NOLEGITCONTENT: barely readable content

Such characteristics can be used to make content checks more difficult. However, the presence of a single characteristic must be assessed in connection with the message’s other tags.

Technical Content Checks

FILECHECK: file attachments were examined
HTMLSCRIPT: script code detected in the HTML content
HTTPREDIRECT: redirects detected
IPINURL: a URL contains a direct IP address

Direct IP addresses in links can be a phishing characteristic and influence a message’s score.

Sender Authentication Checks

SPF

SPFHARDFAIL: SPF check definitively failed
SPFSOFTFAIL: SPF check probably failed

DKIM

DKIM: DKIM check failed

DMARC

DMARC: DMARC check failed

In the documented evaluation, a DMARC tag means that the mail server could not successfully confirm the sender’s authentication. This alone does not make a message spam, but it can increase its spam score.

You can find further information about SPF, DKIM and DMARC in the following article:

https://www.green.ch/en/spf-dkim-and-dmarc-explained

DNS and Routing Checks

REVDNS: check of the reverse DNS or PTR record
HELOBOGUS: the SMTP server identifies itself with an invalid hostname
ROUTING: suspicious routing characteristics detected

Missing or incorrect technical information from the sending mail server can influence a message’s spam score.

Bounce Checks

BOUNCEBLOCK: bounce detected
BOUNCETRACKER: tracking bounce detected
BOUNCELOOP: infinite loop detected
BOUNCEBLOCKER: protection against backscatter

These tags relate to undeliverable messages, automatic responses and protection against backscatter.

Reputation and Signature Checks

ARGDBL: match on a spam protection list
SIGNATURE: match with an updated anti-spam signature
SPAMDOMAINS: domain detected in connection with spam

If a domain or URL is listed on a protection list that is in use, this can increase the spam score of the entire message. In the documented configuration, the SIGNATURE tag leads directly to the Hold action.

Language and Character Set Checks

AFRICAN-CHR
ARABIC-CHR
ASIAN-CHR
CYRILLIC-CHR
GREEK-CHR
HEBREW-CHR
PORTUGUESE-CHR
SPANISH-CHR
TURKISH-CHR

These tags indicate that a message predominantly contains characters from the respective language group. Such a tag does not automatically mean that the message is spam.

Multiple Tags on the Same Message

A message can trigger several checks at the same time. One documented example contains the following tags:

BOUNCETRACKER
WEBBUG
OPTOUT
BULKMAILER
FINGERPRINT
WEIGHT20
WEIGHT30

In this example, WEBBUG, OPTOUT and BULKMAILER indicate typical newsletter characteristics. The various checks contribute to the overall score. WEIGHT20 and WEIGHT30 indicate that the corresponding score thresholds were reached.

Another documented example contains COMMENTS, WEBBUG, BULKMAILER, FINGERPRINT, WEIGHT20 and WEIGHT30. This indicates an HTML message from a mailing system with several additional spam characteristics.

With the BOUNCETRACKER, DMARC, BULKMAILER, PHISHPHINDER and WEIGHT20 tags, characteristics of a bulk mailing were detected together with failed sender authentication and a phishing check.

Check the Cause of Quarantine or Rejection

For a missing or quarantined message, do not check only a single tag. Check all displayed checks and the associated policies.

Sign in to EdgePilot.
Open Email Threat Protection.
Open the email logs.
Search for the affected message using the sender, recipient and time.
Check the status of the message.
Check all displayed tags.
In particular, check WEIGHT20, WEIGHT30, PHISHING, PHISHURL, DMARC, DKIM, SPFHARDFAIL, ARGDBL, SIGNATURE and SPAMDOMAINS.
Compare the tags with the actions in the spam filter policies.

You can find further information about the email logs in the following article:

https://www.green.ch/en/hex-logs

Adjust Spam Filter Policies

To manage the policies, you need an EdgePilot user with administrator permissions.

Sign in to EdgePilot as an administrator.
Open Email Threat Protection.
Open Settings.
Select Spam Filter Policy.
Check which rules are enabled.
Check the actions defined for the individual rules.
Only adjust the policy associated with the tags of the affected message.
Save the changes.

You can find further information about managing the spam filter in EdgePilot in the following article:

https://www.green.ch/en/how-do-i-manage-my-spam-filter-in-edgepilot

You can find further information about assigning administrator permissions in the following article:

https://www.green.ch/en/how-do-i-assign-admin-permissions-to-a-user

Release Messages from Quarantine

With the Hold action, the message is moved to quarantine. Before releasing it, check the sender, content, included links and triggered tags.

You can find further information about releasing a message in the following article:

https://www.green.ch/en/hosted-exchange-release-email-in-edgepilot

You can find further information about managing quarantine in the following article:

https://www.green.ch/en/manage-hosted-exchange-quarantine

Further Information

You can find further information about Hosted Exchange, spam and quarantine in the following articles:

https://www.green.ch/en/all-about-hosted-exchange

https://www.green.ch/en/hex-everything-about-spam-and-quarantine

https://www.green.ch/en/hex-spam-filter-reason-and-responsibility

https://www.green.ch/en/hex-spam-filter-set-too-strictly

https://www.green.ch/en/what-to-do-about-so-much-spam

https://www.green.ch/en/what-is-spam