RE: [IMail Forum] Order of AV and Spam tests

[Daniel Donnelly]

From the IMail 8.2x Getting Started Guide (I don't think there are any major changes for 2006):   Processing Order Incoming mail addressed to a valid local address is processed in the following order. 1 SMTP Access Control. The SMTPD service checks if the connecting IP is listed in the Access Control dialog box. If it is listed in deny access list, the connection is denied. If it is listed in the grant access list, the connection is allowed and processing continues. 2 SMTP Kill File. The SMTP service checks if the email address listed in the "Mail FROM" address command to see if it is listed in the Kill List. If the address or domain is present, the SMTP service returns an error to the connecting client and does not accept the message. If no match is found, the SMTP service accepts the message. 3 Connection Filtering (DNS Black Lists). If you have DNS Black Lists enabled, IMail compares the connecting IP address to the black lists to determine if a match occurs. If a match occurs, the email may be deleted (depending on the DNS Black Lists configuration) or an X-Header may be added and processing continues. 4 Verification Tests. If you have the verification tests enabled, they verify the "Mail FROM" address, the HELO/EHLO domain, and perform a reverse DNS lookup. If any of these checks fail, the email may be deleted (depending on the configuration) or an XHeader may be added and processing continues. 5 Sender Policy Framework (SPF). If you have the SPF feature enabled, it provides increased capability to stop incoming email from forged email addresses. Using a sender authentication scheme, a domain owner requires that legitimate messages from a domain must meet certain SPF criteria. Messages that do not meet the criteria are not accepted as a legitimate email message and are processed according to the SPF options selected on the SPF tab. 6 IMail Anti Virus. If you have IMail AntiVirus installed, it checks the message for infected files or code. If infected, the mail is repaired, bounced, redirected, or deleted, according to the settings on the Anti Virus tab. If the file is not infected, content filtering attempts to identify whether the message is spam. 7 Premium AntiSpam. If you have the optional Premium Antispam filter installed, it provides automated spam protection in addition to the Standard Antispam filter included in IMail. Premium Antispam filter settings are applied before Standard Antispam filter settings. 8 Content Filtering. If you have content filtering enabled, it determines if the message is likely to be spam. If the message is determined to be spam, it is either deleted, sent to the specified address, or an X-Header is inserted. If the message is not spam, aliases are checked. 9 Attachment Blocking. An attachment blocking folder exists for each IP host and the attachment blocking options can be based on the current host or the primary host settings. If you have created and enabled attachment blocking rules, messages that include attachment file types that you have identified as file types to block are blocked from the message. Attachments are blocked based on message MIME types and filename types. You can also define actions to take on blocked messages and a notification message to send the message recipient in place of the original file attachment. 10 Alias. IMail Server checks to see if the addressee matches an alias in the destination domain. An alias is considered to be one of the following: standard alias, group alias, program alias, pager alias, beeper alias, fax alias, or a list-server mailing list name. • If there is a match to a program, beeper, pager, or fax alias, IMail Server executes the program or activates the beeper, pager, or fax. • If there is a match to a standard or group alias, IMail Server resolves the alias to the appropriate user ID(s), and checks the user ID. • If there is a match to a list-server mailing list, IMail Server processes the mail according to the settings for that list. • If there is no match to any alias, IMail Server checks the user ID. 11 User ID. IMail Server determines if the user ID is valid for the destination domain. If invalid, the mail is returned to the sender. If valid, delivery rules are checked. 12 Delivery rules for a list-server mailing list. If the message matches the rule criteria for the list, delivery follows according to that rule. If not, then the message is sent to the list server. If the message is not addressed to a list, Forwarding is checked. 13 Forwarding. IMail Server determines whether an address is present in the Forward box on the General tab for the account. If so, IMail Server forwards the mail. If not, the mail is delivered to the user ID according to the established delivery rules. 14 Delivery rules for the mail host. IMail Server determines if the message matches a rule for the mail host. If so, delivery follows according to that rule. If not, then rules for the user ID are checked. 15 Delivery rules for the user ID. IMail Server determines if the message matches rule criteria for the user ID. If the message matches rule criteria for a user ID, then delivery follows according to that rule. If not, then the Info Manager is checked. 16 Info Manager. IMail Server determines whether the user ID has the Info Manager enabled. If so, the automatic response is sent and the message is delivered to either the forwarding address or (if no forwarding address) to the sub-area or mailbox specified. If the Info Manager is not enabled for this user ID, the vacation setting is checked as described in the next step. 17 Vacation. IMail Server determines whether the user ID has a vacation message enabled. If so, the vacation message is sent. If not, the message is delivered to the User ID.   Daniel Donnelly   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Matrosity Hosting Sent: Monday, September 25, 2006 2:26 PM To: Imail_Forum@list.ipswitch.com Subject: Re: [IMail Forum] Order of AV and Spam tests my understanding from suggesting a different order to ipswitch ts was it would be a major overhaul to change the order. I wouldn't wait on them doing this. Rod Dorman wrote: On Monday, September 25, 2006, 12:14:43, David Gregg wrote: 1) IMail anti-virus scanning 2) IMail connection/DNS based anti-spam tests. Is this really the order it does it in? What's the point of accepting the entire message if you're gonna reject based on IP address? Good point... That's my understanding of the order. Though it would make more sense to do the following: 1) IMail connection based anti-spam tests. 2) IMail anti-virus scanning 3) IMail DNS based anti-spam tests. Then the rest as detailed before. IMHO getting to the DATA phase and doing CPU intensive tests (like anti-spam scanning) should be after any DNS tests. Perhaps the Ipswitch guys can chime in on this one Indeed, an authoritative answer would be nice.