D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 212 / 469

the following actions based on the sum calculated:
1. Dropped
If the sum is greater than or equal to a pre-defined Drop threshold then the email is considered
to be definitely SPAM and is discarded or alternatively sent to a single, special mailbox.
If it is discarded then the administrator has the option that an error message is sent back to the
sending SMTP server (this error message is similar to the one used with blacklisting).
2. Flagged as SPAM
If the sum is greater than or equal to a pre-defined SPAM threshold then the email is considered
as probably being SPAM but forwarded to the recipient with notifying text inserted into it.
A Threshold Calculation Example
As an example, lets suppose that three DNSBL servers are configured: dnsbl1, dnsbl2 and dnsbl3.
Weights of 3, 2 and 2 are assigned to these respectively. The SPAM threshold is then set to be 5.
If dnsbl1 and dnsbl2 say an email is SPAM but dnsbl3 does not, then the total calculated will be
3+2+0=5. Since the total of 5 is equal to (or greater than) the threshold then the email will be treated
as SPAM.
If the Drop threshold in this example is set at 7 then all three DNSBL servers would have to respond
in order for the calculated sum to cause the email to be dropped (3+2+2=7).
Alternative Actions for Dropped SPAM
If the calculated sum is greater than or equal to the Drop threshold value then the email is not
forwarded to the intended recipient. Instead the administrator can choose one of two alternatives for
dropped email:
• A special email address can be configured to receive all dropped email. If this is done then any
TXT messages sent by the DNSBL servers (described next) that identified the email as SPAM
can be optionally inserted by NetDefendOS into the header of the forwarded email.
• If no receiver email address is configured for dropped emails then they are discarded by
NetDefendOS. The administrator can specify that an error message is sent back to the sender
address along with the TXT messages from the DNSBL servers that failed the email.
Tagging SPAM
If an email is considered to be probably SPAM because the calculated sum is above the SPAM
threshold but it is below the Drop threshold, then the Subject field of the email is changed and
pre-fixed with a message and the email is forwarded on to the intended recipient. The tag message
text is specified by the administrator but can be left blank (although that is not recommended).
An example of tagging might be if the original Subject field is:
Buy this stock today!
And if the tag text is defined to be "*** SPAM ***", then the modified email's Subject field will
become:
*** SPAM *** Buy this stock today!
6.2.5. The SMTP ALG Chapter 6. Security Mechanisms
212