Our mail system uses a multi-stage system to help block UCE and many types of well-known computer viruses. However, none of these systems are perfect. Understanding how this system works will help explain why some unwanted messages still make it through.

1. The remote mail client/server connects to the CLASnet mail exchange (MX) server. The MX server performs several anti-spam and anti-virus measures during this initial connection:
   • Check the remote sender's IP against a Realtime Blackhole List (RBL) of known spammer IP addresses. If there's a match, the connection is rejected.
   • Check the message against a database of known email-based viruses. If a match is found, the message is rejected, and the intended recipient will receive a VIRUS ALERT notice. For most purposes, you may ignore these notices.
   • If the message contains a dangerous attachment (ie, "active content" such as bat, com, cpl, exe, pif, vbs, etc.), then the intended recipient will receive a BLOCKED ATTACHMENT notice. If you were expecting the attachment, you can contact the sender and ask them to resend the file in a ZIP attachment. Otherwise, you may ignore it as a probable virus.
   • Rate the message content. Depending on how "spam-like" the message is, it will receive a "score". Higher scores denote more likely to be spam. Any message receiving a score of 7 or above is rejected, and an error is returned to the sender.
   • If the message earns a score above 3.5, the phrase [SPAM] will be prefixed to the subject. You can set your email client to automatically discard or file these, if you so choose.
2. After passing all the MX tests, the message is passed to the CLASnet mail transfer agent (MTA). The MTA decides if the message is for an individual, an individual's forwarding, or for a mailing list. The MTA does no additional filtering.
3. For an individual, the MTA passes the message to the local delivery agent (LDA), which then delivers the message into your INBOX. The LDA performs some mail filtering, but this slows down the mail server, and as such is minimized.
4. Your mail client can further filter the message(s) when you connect to your INBOX via Mozilla or Eudora.

Following these filtering rules, most mail messages will contain a number of additional headers. These headers contain additional information on how the message was scored, as well as diagnostic information. Most users will never need the information contained within the headers, but it is invaluable to CLASnet and Barracuda staff whenever there is a server problem.

X-Virus-Scanned:

Informational header to let us know which mail server scanned the message.

X-Barracuda-Spam-Score:

Number, ranging from -5 to 1000, denoting how "spam-like" the message is. Anything above 3.5 will be marked as [SPAM]. Can be used for client-side filtering.

X-Barracuda-Spam-Status:

"Yes" or "No", followed by a summary of the default score levels. Can be used for client-side filtering.

X-Barracuda-Spam-Report:

Verbose description of what filter rules affected the message score.

X-Barracuda-URL:

Unimplemented feature for per-user mail filters. Later versions may provide support.

X-ASG-Debug-ID:

Internal message identifier used by the Barracuda.

X-ASG-Orig-Subj:

Original, unmodified Subject: line. If the message is tagged as spam, the original subject is modified. The original is kept in case this corrupts foreign-language subject lines.

---

Last updated: Jan 10, 2005 (01:34:45 PM EST)
URL: http://www.clasnet.ufl.edu/howto/mail-filtering/server.shtml