Digest generation and Quarantines

Updated 7 months ago by admin

Email Security will process your Message Rules in priority/rule order. These rules are used, among other things, to determine a Spam Score for each message. The default set of rules contain a Confirmed Phishing, Confirmed Spam and Possible Spam rule. These three rules work together to determine whether a message is quarantined and whether a message is digested (recipients will receive a digest summary of email in their quarantine). If an email triggers a final action on a previous rule, before these three rules, that action is taken and rule processing will stop. Any rules after this will not be triggered.

Quarantined emails are available to release for 30 days

By default, a message with a Spam Score of between 100 and 140 will be quarantined but will be digested and available to users (the Possible Spam rule). All safelists will exclude this email from being quarantined.

A message with a Spam Score of between 140 and 699will be sent to Company Quarantine and will not be digested (the Confirmed Spam rule). All safelists will exclude this email from being quarantined.

A message with a Spam Score greater than 700 will be sent to Company Quarantine and will not be digested (the Confirmed Phishing rule). Global safelists only will exclude this email from being quarantined.

If the message has a Spam Score less than 100, no action will be taken (and further Rules will be allowed to proceed).

Virus-blocked emails will not be digested by default.

Avoiding false positives

Here are some options if you find the spam detection of EMS too aggressive.

Increase the threshold for confirmed spam

  1. Visit your USS Dashboard and click Products ⟶ E-mail Security ⟶ Message Rules.
  2. Select the rule called Confirmed Spam and double-click to edit it.
  3. Under the Selected Conditions column, find the Spam Score condition, and click .
  4. Change the Condition Value to a higher threshold, such as 170.
  5. Click Save.

Disable the Confirmed Spam rule

You can disable the Confirmed Spam rule completely.

This will significantly reduce Email Security's ability to detect and handle spam, and will probably result in an increase of spam emails to your users.
  1. Visit your USS Dashboard and click Products ⟶ E-mail Security ⟶ Message Rules.
  2. Select the rule called Confirmed Spam and double-click to edit it.
  3. Click the Active toggle, to switch it off.
  4. Click Save.

Use Spam Safe Lists

If the false positive spam that you're receiving is coming from only a few domains or a few specific IP addresses, you can add these to the Spam Safe List.

You should avoid having a large Spam Safe List, as this can become a security risk. A faked email address that matches a domain on your Safe List will bypass any spam checks.

How did we do?