Configuring anti-spam

Introduction to anti-spam

GFI MailEssentials tackles spam protection at server level and eliminates the need to install and update anti-spam software on each desktop. GFI MailEssentials uses various methods to identify spam:

Phishing URI Realtime Blocklists (PURBL)

This feature will extract links from the message body and check if they point to known phishing sites or contain typical phishing keywords.

Sender Policy Framework (SPF)

SPF works by publishing a text record in the DNS of domains that indicates which machines send email from that domain. GFI MailEssentials supports SPF and fights spam by checking the SPF record in the received messages. This feature allows you to define the SPF test sensitivity that will be used when processing emails with forged senders (e.g. Block only messages that are determined to have a forged sender).

Whitelists

Whitelists are lists of email addresses, IP addresses and phrases/words from which you always wish to receive email. GFI MailEssentials will automatically build a whitelist for you from outbound email.

Directory Harvesting

This feature blocks emails addressed to users that do not exist on the organization’s mail server. Such email attacks occur when spammers try to send messages, using details from known email addresses together with the most common usernames or possible alphanumeric combinations (brute force approach) that could be used for the username part of an email. This is done in order to try to discover other email accounts present on the same server.

Custom blacklist

This feature allows you to specify domains and email addresses from which you do not wish to receive email.

Bayesian analysis

This feature analyses the content of the inbound email and based on mathematical rules decides if the email is spam or not. The Bayesian filter is discussed in the chapter ’The Bayesian anti-spam filter’.

 

DNS blacklists

This feature allows you to configure GFI MailEssentials to query whether the email sender is on a public DNS blacklist of known spammers. You can also choose to block emails sent from botnet/zombie machines that have their IP listed on SORBS.net.

NOTE: This feature is enabled by default upon installation.

Spam URI Realtime Blocklists (SURBL)

This feature will extract links or domains from the message body and query whether these are listed on public Spam URI Blocklists such as sc.surbl.org

Header checking

This feature analyses the header of the email to detect whether an email is spam or not.

Keyword checking

This feature allows you to configure keywords that indicate if an email is spam.

New Senders

This feature automatically identifies emails that have been sent from senders to whom you have never sent emails. These emails could be from legitimate senders as well as spam which where not detected by the GFI MailEssentials spam filter.

Screenshot 33 - Anti-spam configuration

When GFI MailEssentials finds a spam message, it can delete the message, move it to a central folder, forward it to an email address, tag the email or move it to a user’s junk mail folder.

NOTE: To stop spammers from relaying their email through your mail server, you need to configure your mail server to deny mail relaying. For more information on this, consult the mail server documentation.