SPAM

Anti-Spam Project

ANTI-SPAM SOLUTION UPDATES

  • Proofpoint awarded anti-spam contract.
  • New spam filtering activated Wednesday, April 25, 2007.

SPAM FILTERING ADJUSTED

Due to some false positives being reported, system administrators have adjusted the spam filtering to only discard messages scored 100. This will cause more messages to be filtered to user's quarantine but will allow users to verify any false positives. Once all false positives have been alleviated, then filtering can be adjusted once again to minimize quarantine levels.

IMPORTANT NOTICE ON QUARANTINE

In order to remove messages from the quarantine, you must have received a digest showing the information on the quarantined message. There will be 3 digests sent a day (0700, 1300, 1600) while everyone is getting used to the concept. Only those with messages in the quarantine will receive a digest.

New Anti-SPAM Solution

As you may have heard in the news and experienced in your inbox, spam has more than doubled since this time last year with three out of every four messages being spam for an estimated total of 62 billion spam messages sent a day worldwide. To answer this increase, Clemson will be bringing up a commercial based anti-spam solution for all users by mid April.

To protect our organization from virus attacks and to protect you from receiving hundreds of spam messages, we will filter all incoming email with the Proofpoint Protection Server. Proofpoint uses an advanced machine learning filtering technique called MLX™ to ensure that no valid mail is improperly filtered. For more information about the Proofpoint Protection Server and MLX, you can visit Proofpoint’s web site at www.proofpoint.com.

You can see a demonstration on Proofpoint's technology here.

FAQ - Refer below to common questions about the anti-spam product

How does email filtering work?

All incoming and outgoing email is filtered by the Proofpoint Protection Server. Messages that contain a virus, or spam, or inappropriate content are “scored.” If the messages score high enough, the messages are sent to the Quarantine, where users can “take a look” at them. Only Clemson users that are the recipients of the email are notified of the quarantine...senders are not notified. We are currently not filtering any email sent from a clemson user to the quarantine.

What is the Quarantine?

The Quarantine is a location on a server where email messages are stored temporarily because they might contain spam, a virus, or inappropriate content. If the message is infected with a virus, the virus is removed. You can release your messages from the Quarantine if you determine that they are not spam. Messages that are not released from the Quarantine are automatically deleted after a designated period of time. You cannot see what is in quarantine or release messages until you have received a digest.

What is an End User Digest?

If email messages addressed to you were sent to the Quarantine, you will receive an email notification, called an End User Digest (or Digest), in your mail box. The Digest provides you with a list of the messages addressed to you that are stored in the Quarantine. You can look at the message subject headers to determine their content and as a result what actions you want to apply to the messages.

You may also elect to receive an empty Digest, which is simply an email message indicating that you have no messages in the Quarantine. You may want to receive a Digest even if it doesn't contain any messages, so you can continue to manage certain aspects of your email. In order to receive the empty digest, you must click on "Manage My Account" within a digest which will take you to your account settings on the ProofPoint server.

What do the options in the Digest mean?

There are various options within a digest. Here is a brief explanation for each:

  • Request New End User Digest
    • This will send a new summary digest showing all current messages in the quarantine.
  • Request Safe/Blocked Senders List
    • This will send an email summary of your current safe/blocked list
  • Manage My Account
    • This will take you to the account management interface on the ProofPoint server. Here you can modify your safe/blocked lists and change some settings under your profile like opt to receive empty digests and change your default language.
  • Help
    • Takes you to the help page on the Proofpoint server.
  • Release
    • Releases the message from quarantine and delivers to you via email. Note, that this only affects the current message and has no affect on future messages for this sender.
  • Safelist
    • Adds this sender (or the sender's domain) to your safelist. Future messages from this sender will not be quarantined.
  • Not Spam
    • This reports to the system administrators that the message was not spam. Proofpoint will update its scanning engine about the message characteristics and it will not be quarantined in the future.
  • Score
    • This represents the score for that individual message. Higher scores represent a higher likelihood of the message being spam. A spam score of 100 is automatically discarded and not delivered to quarantine.

Why haven't I received a digest?

You will only receive a digest if there are messages in your quarantine. Some messages that are known to be spam with a score of 100 or automatically discarded. Only messages that are scored within a certain range will go into the quarantine. That range can be adjusted as needed to better meet the needs of the campus as a whole.

Why can't I see the options in the digest in Webmail?

If you are having trouble viewing the digest in webmail, please refer to this page for instructions on changing your viewing settings in webmail.

Why would I want to release a message from the Quarantine?

Sometimes, the Proofpoint Protection Server designates a message as spam even though it's a legitimate email. If you decide you want to read the message, you can release it. Releasing the message removes it from the Quarantine and delivers it to your mail box.

For example, you may be on a mailing list that sends you notices about new movies available on DVD. You want to receive these notices, but the Proofpoint Protection Server takes a conservative approach and scores these messages as spam and sends them to the Quarantine. When you look at your Digest, you will see that these are messages that you indeed want delivered to your mail box.

It is recommended that you add the sender to your safelist to prevent future messages from going to the quarantine.

What happens to my messages in the Quarantine?

If you do not release a message from the Quarantine, it will automatically be deleted after a designated period of time. So if you look at the messages in your Digest, and determine that all of them are spam, you do not need to do anything. The messages will automatically be deleted from the Quarantine.

What is a Safe Senders and Blocked Senders list?

There are two types of Safe Senders lists: the Global Safe Senders List and your personal Safe Senders List. Both are simply lists of legitimate senders of email. The email administrator controls the Global Safe Senders List, which applies to everyone in the organization. You control your personal Safe Senders List to which you can add the addresses of people, organizations, and mailing lists from which you do want to receive mail.

If a sender's address is included in the Safe Senders List, the Proofpoint Protection Server filters the message for a virus or inappropriate content, but does not filter for spam.

There are two types of Blocked Senders lists: Global Blocked Senders List and your personal Blocked Senders List. These lists contain addresses of people, organizations, and mailing lists from which you do not want to receive “junk email.” The email administrator controls the Global Blocked Senders List, which applies to everyone in the organization.

If a sender's address is included in the Blocked Senders List, the Proofpoint Protection Server filters for viruses and inappropriate content, but does not filter for spam before sending it to Blocked folder in the Quarantine.

What is a false positive?

A false positive is an email incorrectly identified as spam. If an email message is scored as spam and sent to the Quarantine, but it really is a legitimate message from a legitimate sender, you can report it as a false positive.

In the future, messages that have the same characteristics as the message you reported will not be placed in the Quarantine for containing spam.

There were some reports initially of email sent through Blackboard and various others that were being incorrectly reported as spam. The system administrators have resolved the problem and all future correspondence from Clemson should not be quarantined.

Someone did not receive my message, was it quarantined?

There were some sent messages incorrectly identified as spam and were quarantined. While every effort possible was made to release those, it is possible that some were discarded. If the recipient has not received the message after 1 day, we recommend that you re-send the message. We have taken steps to prevent any future messages from being quarantined that originated from Clemson users.

What is a false negative?

A false negative is an email incorrectly identified as not spam. An email message that is incorrectly delivered to your mail box because it was not identified as spam can be reported as a false negative. There will be a group of users and support personnel that will have the option to send the false negatives to Proofpoint. If interested in taking part, please notify us of your interests.

Spammers are very clever and are always finding ways to trick products like the Proofpoint Protection Server into delivering spam to your mailbox. Proofpoint sends frequent updates to our organization in an attempt to stay one step ahead of the spammers.

Additional Information/Screen Shots

Here are screen shots of the digest:

  1. End User Digest (Clemson Quarantine Digest)
  2. Safe-Block-List 

Users can also email ITHELP@clemson.edu with any questions they have on the anti-spam solution.