CYREN Premium Filter (Only Premium Versions)

How to get here

In addition to the standard anti-spam filter included with IMail Server, the optional Premium Filter provides fully automated spam protection. The Premium Filter, provided in partnership with CYREN EmailSecurity uses the CYREN GlobalView™ Cloud, which collects and analyzes billions of transactions per day, to deliver unmatched insight into, and protection against emerging security threats. Our patented Recurrent Pattern Detection (RPD) automatically analyzes collected traffic to provide accurate spam and phishing classifications based on a unique global view of outbreaks.

The Premium Spam Filter performance can be improved when users forward spam e-mail to CYREN. CYREN's editors review the spam submission and add spam signature information to it; then the signature is published to the global database to help other users eliminate spam.  

When an incoming message is filtered the CYREN Premium Filter settings are applied before Content Filtering anti-spam settings but after the Connection Checks.

Domain: Shows the current selected domain. From the drop down you can pick any of the domains available to this administrative user account.

The CYREN Premium Filter provides the following classifications for administrators to create, remove, and manage spam.

• Enable Premium Content Filter (selected by default if available). Select this check box to enable the Premium Anti-spam filter for the current mail domain. Default actions are specified to take for each classification. You can, however, change the defaults by clicking the hyperlink under the Classification. The Action to be Taken page appears, with the options for that action listed in a list box.

  Note: Be sure the CYREN Service is started.

• Classification. This column lists all possible classifications with possible results for this domain.
  • Confirmed. Spam messages from known spam sources.
  • Bulk. Spam messages from sources that are not confirmed spammers.
  • Suspected. Legitimate messages that are sent to slightly larger than average distribution or are unidentified spam messages in the first few seconds of a massive spam outbreak.
  • Unknown. Messages for which EmailSecurity does not have any incriminating information, and are therefore assumed to represent legitimate correspondence.
  • NonSpam. Messages that are from a known good source.
• Action to be taken. This column lists the action chosen for each corresponding classification type.
  • None (default). No action is performed on messages identified as spam.
  • Delete Message. Message is deleted immediately after being accepted. If Archiving is enabled, message will archive.
  • Forward to Address. Forwards the message to an e-mail address. Enter an e-mail address in the text box to the right of this option. By default, messages are sent to the root address and stored in a mailbox called "root-bulk". Example.
  • Insert X-Header. Inserts an X-Header into the message indicating that the message was identified as spam by the premium filter. For more information, see X-Header Explanations.
  • Move to Mailbox. Moves the message to the user’s mailbox specified in the text box to the right of this option. If the mailbox does not exist, it is created. The default mailbox is "bulk".
  • Reject Connection. Message is rejected at the MAIL FROM command and the sending mail server is returned a 550 error message.
• Target. This column lists the mailbox or e-mail address for a Move to or Forward to action, respectively.
• Prefix Subject. (Yes/No) This column lists whether or not the message will have a classification prefix added to the message.
• With. This column lists the actual prefix, if chosen, for the corresponding query result.

Tip: We recommend that you select the Insert X- Header option instead of Delete Message until you know that the anti-spam options are setup to best suit your filtering requirements.

Premium Connection Checks (IP Reputation)

CYREN's GlobalView™ Mail Reputation services are used primarily to weed out spam messages and email-borne malware at the entry point before these messages enter the customer’s messaging network, thereby relieving the need for resource-consuming downstream filtering. This is accomplished by applying the most up-to-date IP reputation data to the sender IP, before the SMTP connection is accepted.

By applying GlobalView Mail Reputation services to the senders’ IP addresses before or during the SMTP session and before their messages enter the messaging network, ctIPd delivers cost-effective benefits such as the following:

• Reduce IT resources such as server count, CPU load, storage, etc.
• Eliminating multiple security risks
• Reducing the level of false positives
• Minimizing the cost of downstream filtering
• Lowering the overall bandwidth consumption
• Optimizing IT labor required to manage the overall messaging process

Additionally, CYREN GlobalView Mail Reputation services are used as part of an overall strategy to optimize network accessibility so that the network’s messaging processes are efficient and focused on allowing legitimate sources full and uninterrupted access. At the same time, the CYREN GlobalView Mail Reputation services also make access for unauthorized sources with bad reputations attempting to abuse the network more difficult to achieve.

The following actions for CYREN IP Reputation are:

• Log Only (Set by default). This setting will take no action on any messages, except to log. Connection checks will be made but all messages will be delivered as usual after logging.
• Disabled. This will disable logging and all connection checks.
• Log With Action. This setting will allow the following connection checks.
  • Throttle connections identified as suspected, yet unconfirmed, spam sources.
  • Reject connections identified as confirmed spam sources.
    • Reject and throttle connections on the MAIL FROM command. (Set by default) With IP Reputation enabled, messages will be validated for rejection at the MAIL FROM command and return a 550 error to the sending mail server.
    • Reject and throttle connections on the DATA command. With IP Reputation enabled, messages will be validated for rejection at the DATA command.

      Warning. Setting IP Reputation to validate on the DATA command allows malicious IP's to harvest valid e-mail addresses; since the RCPT TO command occurs before the DATA command.

Related Topic

Default X-Header Classifications

Services for Premium Anti-spam