5.2	Spam Actions - What to do with spam email

The Actions tab in the Anti-Spam filter dialogs define what should be done with emails marked as spam. Different actions can be defined for each of the spam filters.

•	Example: Delete emails detected by SpamRazer filter, but do not delete emails marked as spam by the Keyword Checking filter.

Configuring Spam Actions

Screenshot 47 - Configuring the action that should be taken

1. In the Actions tab, select an option that defines which action to take on emails marked as spam:

•	Delete the email - Delete an email which is blocked by that particular spam filter. Other spam actions are disabled if the email is deleted.

•	Quarantine email - Emails detected as spam will be stored in the Quarantine Store. Other spam actions are disabled if the email is quarantined. For more information refer to Using Quarantine chapter.

•	Deliver email to mailbox - choose the folder where to deliver the email:

o	In Inbox - Use this option to route spam to the user’s Inbox.

o	In Exchange junk email folder - Use this option to route all spam to the user’s default Junk E-mail folder

o	In Exchange mailbox sub-folder - Use this option to route all spam to a specific folder in the user’s mailbox. Click Configure to launch the Move to Exchange folder dialog and type the folder where to move spam email.

	Example 1: Type Suspected Spam for a custom folder to be created in the same level of the Inbox folder.

	Example 2: Type Inbox\Suspected Spam for a custom folder to be created in the Inbox folder.

NOTE 1: This option requires that:

	GFI MailEssentials is installed on the Microsoft Exchange Server machine. If GFI MailEssentials is not installed on the Microsoft Exchange Server, refer to the Moving spam email to user’s mailbox folders chapter in this manual.

	Active Directory mode is enabled.

	The mail server is Microsoft Exchange Server 2003 or Microsoft Exchange Server 2007/2010 with the Mailbox Server Role present.

NOTE 2: For Microsoft Exchange 2010 a dedicated user is required to enable this option. In the Actions dialog click Configure and click Specify user account to specify the dedicated user. In the Move to Exchange configuration dialog, select one of the following options:

	Move spam using an automatically created user - Select this option to let GFI MailEssentials automatically create a user with all the required rights.

	Move spam using the following user account - Select this option to use a manually created user. Specify the credentials (Domain\username and password) of a dedicated user and click Set impersonation rights to assign the required rights to the specified user.

NOTE: The manually specified user credentials must be dedicated to this feature only. The username, password or other properties must not be changed from Microsoft Exchange or Active Directory, otherwise the Move to Exchange folder feature will not work.

•	Send to email address - Send email identified as spam to a specific email address.

o	Example: An email address of a public folder. This way someone can be assigned to periodically check email marked as spam, and identify email that might have been wrongly marked as spam.

The subject of the email will be in the format: [recipient] [subject]

•	Save to specified folder on disk - Saves email detected as spam to the path specified,

o	Example: ‘C:\Spam’.

The file name of the saved email is in the following format:

[Sender_recipient_subject_number_.eml] (for example: C:\Spam\jim@comp.com_bob@comp.com_MailOffers_1_.eml)

•	Tag the email with specific text - Select this option to add a tag to the email subject. Click Configure to modify tagging options. In the Tag Email dialog, key in the text to use for tagging and specify where to place the tag:

o	Prepend to subject - to insert the specified tag at the start (i.e. as a prefix) of the email subject text.

	Example: ’[SPAM]Free Web Mail’.

o	Append to subject - to insert the specified tag at the end (i.e. as a suffix) of the email subject text.

	Example: ‘Free Web Mail[SPAM])’.

o	Add tag in an X-header… - to add the specified tag as a new X-header to the email. In this case, the X-Header will have the following format :

X-GFIME-SPAM: [TAG TEXT]

X-GFIME-SPAM-REASON: [REASON]



Example:

X-GFIME-SPAM: [This is SPAM]

X-GFIME-SPAM-REASON: [IP DNS Blocklist Check failed - Sent from Blocklisted Domain]

•	Append block reason to email subject - If this option is enabled, the name of the filter which blocked the email and the reason for blocking are appended to the subject of the blocked email.

Other options

Screenshot 48 - The other actions tab

Select the Other tab, to specify a number of optional actions:

•	Log occurrence to this file - Log the spam email occurrence to a log file of your choice.

NOTE: Log files may become very large. GFI MailEssentials enables log rotation, where new log files are created periodically or when the log file reaches a specific size. To enable log file rotation navigate to Anti-Spam ► Anti-Spam Settings. Select Anti-spam logging tab and check Enable log file rotation. Specify the rotation condition by time or file size.

NOTE: When the GFI MailEssentials installation is an upgrade from version 14 or less that used the fake Non Delivery Report (NDR) action, the option to create a fake NDR is retained. This feature is not included in GFI MailEssentials 2010 since it can be a threat to the mail flow system. For more information about sending fake NDRs refer to:

http://kbase.gfi.com/showarticle.asp?id=KBID002898

5.2.1

Anti-spam global actions

A lot of spam is sent to email addresses that no longer exist. Generally, these emails are simply deleted however for troubleshooting or evaluation purposes, you might want to move these emails to a folder or forward them to a particular email address.

NOTE: This section applies only for installations on Microsoft Exchange Server that have the Move to subfolder of user’s mailbox enabled. Refer to the Spam Actions - What to do with spam email section in this manual for more information how to enable this feature.

On other servers, the anti-spam global actions tab will not appear.

Configuring Anti-spam global actions

1. Right click Anti-Spam ► Anti-Spam Settings node and select Properties.

Screenshot 49 - Global actions

2. Select Global Actions tab and choose whether to:

•	Delete the email

•	Forward it to an email address

•	Move it to a specified folder.

3. Select the Log occurrence to this file to log spam to a log file.