Spamblocker Categories; Spamblocker Actions; Spamblocker Exceptions; Configuring Spamblocker - Watchguard Firebox X20E User Manual

Configuring spamBlocker

spamBlocker categories

spamBlocker puts spam email into three categories: Spam, Bulk and Suspect. spamBlocker assigns
email messages to these categories using the spam score returned from a scoring request sent to the
Commtouch Detection Center.
The Spam category includes email messages that come from known spam senders.
•
The Bulk category includes email messages that do not come from known spam senders, but do
•
match some known spam structure patterns.
The Suspect category includes email messages that could be associated with a new spam attack.
•
Frequently, these messages are legitimate email messages. It is a good idea to think of suspect
email as "not spam" unless you have verified that they do not produce false positive results for
your network.

spamBlocker actions

The Edge uses spamBlocker actions to apply decisions about the delivery of an email message that is
spam. When the email message is assigned a category, the related action that you configure is applied:
Allow
Let spam email messages go through the Edge without a tag.
Add a Subject Tag
Insert text in the subject line of the email message to mark it as spam, bulk, or suspect. You can
keep the default tags for each category or you can customize them. After you have set the Tag
action, you can then create rules in your email reader to sort or delete the spam automatically.
See "Configuring Rules For Your Email Reader" on page 189 for more information.
Deny
Stop the spam email message from being delivered to the mail server. The Firebox sends this 571
SMTP message to the sending email server: "Delivery not authorized, message refused". This
option is available only when you configure spamBlocker for SMTP.

spamBlocker exceptions

You can create an exception list to the general spamBlocker actions that is based on the sender's
address. For example, if you want to allow a newsletter that spamBlocker identifies as Bulk email, you
can add that sender to the exceptions list and designate the Allow action regardless of the category.
Or, if there is a sender that spamBlocker thinks safe that you want to apply a tag to, you can add that to
the exceptions list as well.
It is important to know that exceptions are based on the "To" and "From" headers in the email. It is pos-
sible to spoof that header information. The more specific the addresses in your exceptions list, the
more difficult it will be to spoof them. We suggest that you use care when adding wildcards to the list.
Configuring spamBlocker
1spamBlocker™ works with the POP3 and SMTP proxies to scan your email. If you have not configured
the POP3 or SMTP proxy, they are enabled when you configure the spamBlocker service. If you have
more than one proxy policy for POP3 or for SMTP, spamBlocker works with all of them.
186 Firebox X Edge e-Series