Custom Website Designers

Nationwide:
877.723.3136

Home - Products - CleanMail

CleanMail - Spam Filtering: Features

CleanMail utilizes three layers of protection to analyze each piece of email and to detect and act on suspected spam.

Blacklisting: GHI uses a proprietary blacklist. We do not use commercial blacklists such as MAPS and ORBZ/S. Most commercial and public blacklists follow a "guilty until proven innocent" approach, which frequently blocks email from legitimate senders. Our blacklist contains only the addresses of the most egregious spammers on the Internet. While conservative, our blacklist can immediately block nearly 10 percent of our customer's inbound spam.

Fingerprinting: Messages not blocked by blacklisting are fingerprinted to detect matches with known spam message characteristics. GHI's fingerprinting technology leverages knowledge gained from filtering mail for our entire customer base. The fingerprinting database aggregates data from all spam blocked by our system allowing the fingerprinting process to become more intelligent and refined as more mail is processed.

Messages identified as spam are fingerprinted and given a unique id based on their content. If these messages come through our system again, the fingerprint is detected and the message is marked as spam. Messages are analyzed to determine new spamming methods (i.e., base64-encoded spam). Once determined, a dedicated spam team modifies our scoring layer on the fly to catch spam using the same method.

Rules-based scoring: Scores are assigned to messages based on more than 20,000 rules that embody and define characteristics of spam and legitimate email. Points are added to the score if a message contains characteristics of spam; and points are subtracted if it contains many characteristics of legitimate email. When a message's score reaches a defined threshold, it is flagged as spam. Message characteristics we evaluate and score include:

  • Phrases in the body and subject of the message
  • Formation of headers (i.e., Message-ID, Received, random characters)
  • Originating mail server / Originating mail agent
  • From and SMTP From address

Spam Treatment

Most customers choose to quarantine messages identified as spam outside their network. Quarantined messages are stored and deleted after 15 days. Customers can review quarantined messages and retrieve improperly blocked messages through SpamShark, a Web-based tool.

Unlike most competitors, CleanMail has a very low incidence of blocking legitimate email - less than one for every 250,000 emails received (less than 0.0004 percent).

As an alternative to quarantining messages, CleanMail also allows spam to be sent through to customers. When CleanMail forwards spam, it can modify the message to flag it for internal review. Modifications can include:

  • Inserting an X-header for filtering inside the perimeter
  • Inserting a new subject line message (i.e., < This is spam >)
  • Directing spam to an internal SMTP mailbox

More about professional spam filtering services.