Digest generation and Quarantines
Email Security will process your Message Rules in priority/rule order. These rules are used, among other things, to determine a Spam Score for each message. The default set of rules contain a Confirmed Phishing, Confirmed Spam and Possible Spam rule. These three rules work together to determine whether a message is quarantined and whether a message is digested (recipients will receive a digest summary of email in their quarantine). If an email triggers a final action on a previous rule, before these three rules, that action is taken and rule processing will stop. Any rules after this will not be triggered.

By default, a message with a Spam Score of between 100
and 140
will be quarantined but will be digested and available to users (the Possible Spam rule). All safelists will exclude this email from being quarantined.
A message with a Spam Score of between 140
and 699
will be sent to Company Quarantine and will not be digested (the Confirmed Spam rule). All safelists will exclude this email from being quarantined.
A message with a Spam Score greater than 700
will be sent to Company Quarantine and will not be digested (the Confirmed Phishing rule). Global safelists only will exclude this email from being quarantined.
If the message has a Spam Score less than 100
, no action will be taken (and further Rules will be allowed to proceed).
Avoiding false positives
Here are some options if you find the spam detection of EMS too aggressive.
Increase the threshold for confirmed spam
- Visit your USS Dashboard and click Products ⟶ E-mail Security ⟶ Message Rules.
- Select the rule called Confirmed Spam and double-click to edit it.
- Under the Selected Conditions column, find the Spam Score condition, and click
.
- Change the Condition Value to a higher threshold, such as
170
. - Click Save.
Disable the Confirmed Spam rule
You can disable the Confirmed Spam rule completely.
- Visit your USS Dashboard and click Products ⟶ E-mail Security ⟶ Message Rules.
- Select the rule called Confirmed Spam and double-click to edit it.
- Click the Active toggle, to switch it off.
- Click Save.
Use Spam Safe Lists
If the false positive spam that you're receiving is coming from only a few domains or a few specific IP addresses, you can add these to the Spam Safe List.