X-Spam Features

Mail Protocol Layer Checks
X-Spam performs a series of checks at the protocol layer to check for Spam. Figure 1 gives a screen shot from X-Spam with these features

The checks are explained below:

Real-time Black List (RBL)
An RBL is a DNS server that lists IPs of known Spam sending machines. RBL checking in X-Spam for Exchange 2000-2003 is carried out at the SMTP protocol level when the sending mail server connects to your mail server. If the IP is found to be in any one of the blacklists, the connection is terminated.

Dialup User's List (DUL)
A DUL is a DNS server that lists IPs of machines that are known to be part of the IP-range assigned to dialup Internet accounts. Spammers prefer using dialup accounts to send mail since they are easy and cheaper to sign up for and dispose. Most legitimate dialup user's usually connect to their ISPs mail servers or an Internet email account to send mail. The list of DULs is extensible just like RBL. If a connecting IP is found to be in any one of the blacklists, the connection is terminated.

MX/A DNS record verification
The domain part of the email address given in the "MAIL FROM" SMTP command is checked to see if it has a DNS MX (mail server) and/or A (IP) record.. Spammers or mis-configured client programs are the only ones who use non-existent domains in their emails. However, in either case it is absolutely valid to refuse acceptance of mail.

Reverse DNS
A reverse DNS check is performed to see if the connecting IP resolves to a valid domain name. Most properly configured mail servers usually have a reverse lookup (PTR) record entry in DNS. Further verification for the legitimacy of the resolved domain is done by checking if there is a sub domain match with the domain in "HELO/ELHO" and/or the "MAIL FROM:" SMTP commands. Since a majority of mail servers do not have a reverse lookup, this feature is disabled by default.

IP/Host/User Restriction From List

• Whitelist: If an IP/Host/User is on this list, all mails from that IP or from that user/domain are accepted.
• Blacklist: If an IP/Host/User is on this list, all mails from that IP or from that user/domain are rejected.

• Whitelist: If a Host/User is on this list, all mails to that user/domain are accepted.
• Blacklist: If an Host/User is on this list, all mails to that user/domain are rejected.
  

E-mail Content Checks

E-mail Content Checks
X-Spam performs rigorous email content checks. Figure 2 gives a screen shot from X-Spam with these features.

• It can be moved to a special Spam folder in a user's inbox for an IMAP setup.
• It can be tagged in the subject line. A special header can be inserted to indicate it is Spam.
• The mail can be deleted although we do not recommend this since false positives can then never be recovered.

Relay-Control
It provides Relay Control using IP-blocks (to ensure that unauthorized IP addresses are blocked from sending mails through the Mail Server). X-Spam SMTP proxy can handle multiple domains. It provides Hop Control to ensure that the mails do not loop and also provides routing facilities.

• IMail.
  
• SLMail.
  
• WinGate (Proxy used for POP3/SMTP Traffic).
  
• Omnigate.
• MailGate.
  
• Agrosoft.
  
• FTGate, etc.
  

MailScan 4 for Mail Server acts like a Content-Security and Anti-Virus Software for your Corporate Mail Server. It scans and cleans e-mails that:

A) Flow between all the local users.
B) Are sent from your Mail Server to the Internet
C) Come into your Mail Server from the Internet (either via SMTP or POP3).

MailScan is the only solution available in the world that transparently works on SMTP and POP3 traffic.

It has the world's first e-mail Content-Security and Anti-Virus feature that analyzes e-mails on a real-time basis before they are delivered to the clients or the servers on your network. Both SMTP and POP3 are supported.

Technically, a new layer MicroWorld WinSock Layer (MWL) is placed between the default WinSock2 and the applications. MWL analyzes traffic that flows between Mail Server and the Internet or your applications.

Besides providing Anti-Virus and Content-Scanning features, MailScan also has a Generic Attachment Analyzer, automatic compression/decompression feature, a comprehensive Notification Engine, etc.

MailScan uses eScan Content-Security and Anti-Virus solution to scan all e-mail attachments. Incoming and outgoing e-mails are scanned and cleaned and their contents checked, before your e-mail server processes them.

All MailScan processes are multi-threaded. This ensures that all e-mails are parallely processed.

All types of attachments are handled by MailScan, including MIME and UUEncoded.

RFC822 attachments, Embedded e-mails, Multipart-Mixed and Multipart-Digest types are also supported.