Commtouch Premium Filter (Only Premium Versions)

How to get here

In addition to the standard antispam filter included with IMail, the optional Premium Filter provides fully automated spam protection. The Premium Filter, provided in partnership with Commtouch Advanced Security Daemon (a.k.a. ctasd™) is a plug-and-play e-mail-borne spam and malware outbreak detection daemon that combines your current core messaging network infrastructure with advanced detection and classification capabilities. The daemon adds a layer of e-mail filtering to your mail delivery system in order to provide real-time classification, already in the first minutes after a new outbreak is launched.

The Premium Spam Filter performance can be improved when users forward spam e-mail to Commtouch. Commtouchs' editors review the spam submission and add spam signature information to it; then the signature is published to the global database to help other users eliminate spam.  

When an incoming message is filtered the Commtouch Premium Filter settings are applied before Content Filtering antispam settings but after the Connection Checks.

The Commtouch Premium Filter provides the following classifications for administrators to create, remove, and manage spam.

Domain: Shows the current selected domain. From the drop down you can pick any of the domains available to this administrative user account.

• Enable Premium Filter (selected by default if available). Select this check box to enable the Premium Antispam filter for the current mail domain. Default actions are specified to take for each classification. You can, however, change the defaults by clicking the hyperlink under the Classification. An Action to be Taken page appears, with the options for that action listed in a list box.

  Note: Be sure the Commtouch Antispam Service is started.

• Classification. This column lists all possible classifications with possible results for this domain.
  • Confirmed. Spam messages from known spam sources.
  • Bulk. Spam messages from sources that are not confirmed spammers.
  • Suspected. Legitimate messages that are sent to slightly larger than average distribution or are unidentified spam messages in the first few seconds of a massive spam outbreak.
  • Unknown. Messages for which ctasd does not have any incriminating information, and are therefore assumed to represent legitimate correspondence.
• Action to be taken. This column lists the action chosen for each corresponding classification type.
  • Delete. Immediately deletes the message.
  • Forward to Address. Forwards the message to an e-mail address. Enter an e-mail address in the text box to the right of this option. By default, messages are sent to the root address and stored in a mailbox called "root-bulk". Example.
  • Insert X- Header. Inserts an X- Header into the message indicating that the message was identified as spam by the premium filter. For more information, see X-Header Explanations.
  • Move to Mailbox. Moves the message to the user's mailbox specified in the text box to the right of this option. If the mailbox does not exist, it is created. The default mailbox is "bulk".
  • None (default). No action is performed on messages identified as spam.
• Target. This column lists the mailbox or e-mail address for a Move to or Forward to action, respectively.
• Prefix Subject. (Yes/No) This column lists whether or not the message will have a classification prefix added to the message.
• With. This column lists the actual prefix, if chosen, for the corresponding query result.

Tip: We recommend that you select the Insert X- Header option instead of Delete until you know that the antispam options are setup to best suit your filtering requirements.

The following actions apply to spam filtering of message header content. These options are available on the Premium Filter Settings page. (Click Services > Antispam.)

Premium Connection Checks (IP Reputation)

Commtouch's GlobalView™ Mail Reputation services are used primarily to weed out spam messages and email-borne malware at the entry point before these messages enter the customer's messaging network, thereby relieving the need for resource-consuming downstream filtering. This is accomplished by applying the most up-to-date IP reputation data to the sender IP, before the SMTP connection is accepted.

By applying GlobalView Mail Reputation services to the senders' IP addresses before or during the SMTP session and before their messages enter the messaging network, ctIPd delivers cost-effective benefits such as the following:

• Reduce IT resources such as server count, CPU load, storage, etc.
• Eliminating multiple security risks
• Reducing the level of false positives
• Minimizing the cost of downstream filtering
• Lowering the overall bandwidth consumption
• Optimizing IT labor required to manage the overall messaging process

Additionally, Commtouch GlobalView Mail Reputation services are used as part of an overall strategy to optimize network accessibility so that the network's messaging processes are efficient and focused on allowing legitimate sources full and uninterrupted access. At the same time, the Commtouch GlobalView Mail Reputation services also make access for unauthorized sources with bad reputations attempting to abuse the network more difficult to achieve.

The following actions for Commtouch IP Reputation are:

• Log Only (Set by default). This setting will take no action on any messages, except to log. Connection checks will be made but all messages will be delivered as usual after logging.
• Disabled. This will disable logging and all connection checks.
• Log With Action. This setting will allow the following connection checks.
  • Throttle connections identified as suspected, yet unconfirmed, spam sources.
  • Reject connections identified as confirmed spam sources.
• Reject and throttle connections on the MAIL FROM command. (Set by default) With IP Reputation enabled, messages will be validated for rejection at the MAIL FROM command.
• Reject and throttle connections on the DATA command. With IP Reputation enabled, messages will be validated for rejection at the DATA command.

  Setting IP Reputation to validate on the DATA command allows malicious IP's to harvest valid e-mail addresses; since the RCPT TO command occurs before the DATA command.

Related Topic

Default X-Header Classifications

Services for Premium Antispam