Using Spam Filters

NOTE:  As of January 2010, MXLogic is now McAfee.

Table of Contents

• Spam vs. Virus Category
• Managing Spam Messages
• McAfee Control Console
• Creating Allow/Deny Lists

Jefferson Lab (JLab) has contracted with an outside company to provide spam and virus filtering for all incoming messages.  All messages destined for JLab from the outside will first pass through the vendor's filters and then be sent to JLab for delivery.  There are several actions that can be triggered by an incoming message.  They are in either the spam category, or the Virus category.

Things that can happen to spam:

1. If the filter is more than 99% sure that the message is spam, the message will be thrown away.  The sender will not receive a message saying it was thrown away, and the recipient will receive no notice that it was thrown away.  The vast majority of spam will fall into this category.
2. If the filter thinks it is probably spam, but not above 99% sure, the message will be quarantine at the vendors site.  Each user will have their own quarantine space and have control over it.
3. If the filter thinks the message is not spam, it will be passed through and delivered to the intended recipient.

Things that can happen to Viruses:

1. If the message is infected with a common, well known mass mailing virus, the message will be thrown away.  The sender will not receive a message saying it was thrown away, and the recipient will receive no notice that it was thrown away.  The vast majority of viruses will fall into this category.
2. If the attachment can be cleaned, it will be and the message will be delivered intact.
3. If the attachment can not be cleaned, it will be stripped out of the message and the message will be delivered with a footnote stating that an attachment has been stripped.

Managing Spam Messages

The spam quarantine report (SQR) is an automatically generated report sent to your email address that lists the emails that have been filtered because of potential spam content.  The frequency of the SQR email is customizable by each user, however, the default is for the report to be sent each Monday, Wednesday, and Friday.  The SQR contains command links that allow you to manage your quarantined email and change your configurations.  After you select an action command, you are automatically sent to the Control Console and the appropriate window opens.

NOTE:  If you have opted out of receiving SQRs, please contact the IT Division Help Desk.  We can turn your SQRs back on for you.

When you receive an SQR email, there are several things you can do:

• Release an email to be delivered to your Inbox with a single click
• Delete a message from the quarantine area (this will delete the email permanently)
• Select Always Allow, which will force the service to always allow messages from that particular email address to pass through the spam filters
• Select Deny, which will force the service to always throw away messages from that particular address

To change your preferences and spam report settings, use the click here link at the very bottom of the above email.  When you click the link, a browser window will open.  From there, you may edit your account settings to perform the functions listed above.

McAfee Control Console

There are several things you can do with spam that gets through the filters and ends up in your Inbox.

1. Forward the message to spam@jlab.org.  This will help train the spam filters to perform better and filter out more spam.
2. You can place the sender's email address in the Allow/Deny list of the SQR to accept or block that particular sender.
3. You can place the sender's entire network (*company.com)  in the Allow/Deny list of the SQR report to block all messages from that company from reaching you.

Please read Creating Allow/Deny Lists below for examples of acceptable entries you can add to your Allow/Deny lists.

Creating Allow/Deny Lists

Through the McAfee Control Console, you can create Allow/Deny lists by going to the Allow/Deny tab as seen in the window above.  Under the Allow/Deny tab, you can edit addresses you have added using the Always Allow or Always Deny links in the Message Quarantine window.  You can also add specific email address or entire domains that you want to always allow or always deny.

In the table below, please find examples of acceptable entries.  For these examples, the sender is username and the domain is spamsite.org.

Please contact the IT Division Help Desk with any questions or concerns regarding our spam filtering service.  For users that wish to explore the features of this service further, there is a document available to download and read.  MX Logic SPAM Quarantine Report and Web Portal Users Guide.