The top two, most important points to remember about the SPAM configuration are:

1. The server will NEVER delete a message because it thinks the message is SPAM. The server will only modify the Subject and Header of the message.
2. WJU Administrators do NOT scan email during the SPAM process. The server receives updates to the SPAM configuration from the software vendor, IPSwitch.

There are five possible ways for a message to be identified as SPAM. These test are abbreviated CONN, PHRASE, STAT, URL-DBL, and HTML. When performing testing on a message during the PHRASE, URL-DBL sections, the server uses a database of over 850 common phrases and over 38,000 mail and web sites that are most commonly used for SPAM.

Connection Filtering

The first step in identifying SPAM is to check some information during the delivery of a message. The remote server that is contacting WJU will have to answer some questions about who it is. If these questions are not answered satisfactorily, then the message has failed the CONN test.

• Verify MAIL FROM Address: The remote server tells the WJU server the email address that would like to deliver the message. The WJU server then contacts the email address user's server to verify the account actually exists. If the account does not exist, the message is marked as SPAM.
• Reverse DNS lookup on server: The WJU server uses the IP address of the remote server and tries to lookup the name of the server. If the address lookup does not return a name, the message is marked as SPAM.
• Verify HELO Domain: The WJU server uses the name of the remote server and tries to lookup the IP address of the server. If a name record cannot be found, the message is marked as SPAM.

Content Filtering

Content filtering is broken into several steps: phrase filtering, statistical filtering, and HTML filtering. Each step examines the content of the message to determine if it is SPAM.

• Phrase filtering: Searches are made for phrases that indicate spam. Currently, over 850 common phrases (i.e. Mortgage Interest Rates) are in the search list. If a message fails this section, the message is marked with the PHRASE: tag.
• Statistical filtering: Comparisons of each word in a message are made against collected word counts and a SPAM probability value is created for the message. If the probability value is higher than 90%, the message fails and is marked with the STAT: tag.
• HTML filtering: Special HTML tags and domain names in URLs are examined for domain names that are known to send SPAM. Currently, over 32,500 domain names are in the list. If a message fails this section, the message is marked with the URL-DBL: tag. Other messages that contain HTML tags that the server is not sure of will be marked with the HTML: tag.