Digest generation and Quarantines

Updated 1 year ago by admin

Email Security will process your Message Rules in priority order. These rules are used, among other things, to determine a Spam Score for each message. The default set of rules contain a Confirmed Spam rule and Possible Spam rule. These two rules work together to determine whether a message is quarantined and whether a message is digested.

Quarantined emails are available to release for 30 days

By default, a message with a Spam Score of between 100 and 140 will be quarantined but will be digested and available to users (the Possible Spam rule).

A message with a Spam Score greater than 140 will be sent to Company Quarantine and will not be digested (the Confirmed Spam rule).

If the message has a Spam Score less than 100, no action will be taken (and further Rules will be allowed to proceed).

Virus-blocked emails will not be digested by default.

Avoiding false positives

Here are some options if you find the spam detection of EMS too aggressive.

Increase the threshold for confirmed spam

  1. Visit your USS Dashboard and click Products ⟶ E-mail Security ⟶ Message Rules.
  2. Select the rule called Confirmed Spam and double-click to edit it.
  3. Under the Selected Conditions column, find the Spam Score condition, and click .
  4. Change the Condition Value to a higher threshold, such as 170.
  5. Click .

Disable the Confirmed Spam rule

You can disable the Confirmed Spam rule completely.

This will significantly reduce Email Security's ability to detect and handle spam, and will probably result in an increase of spam emails to your users.
  1. Visit your USS Dashboard and click Products ⟶ E-mail Security ⟶ Message Rules.
  2. Select the rule called Confirmed Spam and double-click to edit it.
  3. Click the Active toggle, to switch it off.
  4. Click .

Use global safe lists

If the false positive spam that you're receiving is coming from only a few domains or a few specific IP addresses, you can add these to the Global Safe List.

You should avoid having a large Global Safe List, as this can expose a security hole. A faked email address that matches a domain on your Safe List will bypass any spam checks.

How did we do?