vodafone hosted services hosted email anti-spam user guide · tagging the email involves either...

Vodafone Hosted Services

Hosted Email Anti-Spam User Guide


1

Welcome to the Vodafone Hosted Email Anti-Spam Guide. This guide is designed to help protect your inbox from unwanted email by taking you through the wide range of control functions and features, ensuring you only receive the emails you want to receive.

Please refer to the Help section in Vodafone Hosted Email for more information or if you require further support.

Contents

Audience 3

Conventions 3

Most common acronyms 3

Email Actions 3

Access to Anti-Spam portal 5

Overview tab 6

Configuration section 6

Statistics section 7

Charts section 8

Quick search bottom tab 12

Search tab 13

Search Results 15

Message details 16

Setup tab 18

Anti-Spam Settings 18

Whitelist 19

Blacklist 21

Disclaimer 23

Reports tab 25

Schedule Reports and Current Schedule 26


2

1 Audience

This guide is especially aimed at Customer Administrators.

This guide is aimed at an audience with specific technical competences in the IT areas of email and network management.

1.1 Conventions

The following conventions shall be used:

• Bold: graphical User interface elements like options, menus or buttons

• Red: references topics in this document

• Courier: paths, URLs, text to be typed by the User

• <TERM>: generic terms.

1.2 Most common acronyms

A-record: IP address record (for example, 194.163.43.3) - One of the record types used by the DNS system.

CIDR: Classless Inter Domain Routing - A new way of interpreting IP addresses, without requiring pre-defined eight bit blocks classes (allows network and host length to vary with more flexibility).

MTA: Email Transport Agent Server software such as Postfix, qmail or MS Exchange.

RBL: Real-time Black Hole List - This is actually more of an umbrella term used to refer to the various forms of DNS blacklists.

SMTP: Simple Email Transfer Protocol - Used for communication between MTAs.

1.3 Email Actions

1.3.1 Messages classification

The MPS classifies email messages into six categories:

1. Clean: email that is considered suitable for delivery at its final destination

2. Spam: email that is considered to be probable spam

3. High Spam: email that is considered to be spam

4. Virus: email that contains virus, typically found in attachments

5. Reject: email that is rejected for several possible reasons, outlined below

This email rejection occurs during analysis of the email header (For example, rejected email is cast out before entering the system and it is not further processed)


3

6. Policy Blocked: email is classified as Policy Blocked when it triggers defined rules, for example, anti-spam or attachment rules; this settings and execution of rules are further discussed in the section: Users.

The incoming email is rejected for five possible reasons:

• Sender reject: email is rejected because sender is unknown

• Bad helo: email is rejected because an invalid helo (or ehlo) is sent

• Domain unknown – the message is sent to a domain that is not configured to accept messages

• RCPT reject: email is rejected because recipient is unknown

• RBL block: email is rejected because source IP address has bad reputation.

1.3.2 Email tagging

Incoming email that meets certain system defined rules and policies will be tagged on arrival. Tagging the email involves either appending text to the subject field, or appending a specific header to the existing email header. Tagged email is forwarded to the intended recipient instead of being discarded.

1.3.3 Email discard

Incoming email that meets certain system defined rules and policies will be discarded after processing. Email is completely removed from the system and cannot be retrieved at a later date.


4

2 Access to Anti-Spam portal

After logging in to Vodafone Hosted Services Portal, choose the Anti-Spam tab to enter.

Figure 2-1 Self Care portal -> tab Anti-Spam

Vodafone’s Anti-Spam portal will appear in a different internet browser tab (avas.vhsmail.vodafone).

The Anti-Spam Portal’s starting page appears.

Figure 2-2 Anti-Spam portal tabs

In the Anti-Spam portal, four tabs are visible:

• Overview: displays high level details of the anti-virus/anti-spam configuration for the domain

• Search: the section for searching and handling messages

• Setup: the section for configuring the system

• Reports: the section for setting up system and domain reports.


5

3 Overview tab

The first screen viewed is the Overview tab:

• Configuration: where settings for Anti-Spam and Whitelist /Blacklist are visible

• Statistics: statistics of the messages, the action taken and the message classification

• Charts: several charts concerning messages and anti-spam actions

• Quick Search: a quick search function to rapidly find a user’s messages details.

Figure 3-1 The starting screen (and content of Overview)

3.1 Configuration section

This small section allows you to view the following details:

• Anti-spam:

o Spam score Thresholds: current definition for Spam score. The value set determines the strength of email blocked by the system.

• Whitelist/Blacklist:

o Whitelist: emails sent to whitelist

o Blacklist: emails sent to blacklist.

These details refer to the number of address and domain entries in the lists.


6

Figure 3-2 Configuration section of Overview (example)

3.2 Statistics section

The different views are available in the dropbox (on the right) and these are:

• Message Classification: shows the aggregated number of clean, rejected, spam, virus and policy messages for the last 24 hours for both Inbound Traffic and Outbound Traffic.

• Action Taken: this is similar to Message Classification, but instead of classifying messages by type (clean, spam, and others), it classifies messages according to the way the system acted upon them: quarantined, discarded, tagged or forwarded

• Message Statistics: shows the volume, the total number of messages and the message rate (in messages per second) for the last 24 hours. If referring to site wide, aggregated values are shown.

Figure 3-3 Statistics section (View: message classification)


7

3.3 Charts section

This section shows graphical representations of the classification and volume of data for different time frames (last 24 hours, last 30 days and last year are the options available).

The following graphics are available for the selected Domains:

• Message classification

• Bad email breakdown

• Good email vs. bad mail

• Filter actions

• Volume

• Volume vs. messages.

Select the data to view from the left selection box, and the time frame from the right selection box.

3.3.1.1 Message Classification (filter)

The message classification chart, an option in the chart section, displays how the received messages were classified.

Figure 3-4 Message classification chart

• Clean (Green): email that is accepted for delivery to its final destination

• Spam (Orange): both Spam and High Spam are displayed here

• Virus (Red): email that contained virus, typically found in attachments

• Rejections (Blue): email that was rejected during analysis of the Email header, i.e. (it is never processed)

• Policy (Grey): email that was classified as Policy Blocked when it triggered one or more defined rules (for example, anti-spam or attachment rules).


8

3.3.1.2 Bad Email Breakdown (filter)

The Bad Email breakdown option displays a pie chart that shows how the bad email that reaches the organization is divided. The areas of this chart represent:

Figure 3-5 Bad Email breakdown chart

3.3.1.3 Good Email vs. bad Email (filter)

Good email vs. bad email chart shows the percentages of good and bad traffic, which arrived to the organization, in the specified time frame. Good email includes only the clean email whereas bad email includes messages that were considered spam, high spam or virus, messages that were rejected and messages that were blocked by policies.

Figure 3-6 Good email vs. bad email chart


9

3.3.1.4 Filter actions (filter in Inbound chart)

The Filter Actions chart shows the actions that were performed on the email traffic that reached the filter (rejected traffic does not reach the filter). The possible Actions are summarised in the following table:

Figure 3-7 Filter Actions chart

Action Description

Forwarded Mail that is forwarded to the final destination.

Quarantined Mail that is moved to the Quarantine;

TaggedMail subject is tagged with a specific message in the subject; also a specific header may be appended to email's header;

Discarded Mail that is removed from the system

Table 3-1 Action Field


10

3.3.1.5 Volume (filter in Inbound chart)

The Volume chart shows the traffic volume of the received messages.

Figure 3-8 Volume chart

3.3.1.6 Volume vs. Messages (filter in Inbound chart)

The Volume vs. messages chart shows the traffic volume of the received messages compared to the number of messages received. Under normal circumstances the two patterns are similar (if the size of each message is regular)

Figure 3-9 Volume vs. messages chart


11

3.4 Quick search bottom tab

In the lower right corner of the overview tab it is possible to perform one of the most commonly used features when changing anti-spam settings: finding a message for a particular address.

The Quick Search box enables you to quickly search for messages, with the option of restricting the search to quarantine only. The input format used should be [email protected].

Figure 3-10 Quick search box

After you click Search, the interface automatically changes to the Search tab and the new filter is automatically added and executed.


12

4 Search tab

By clicking the magnifier symbol, which appears before a sender or receiver’s email address, the correspondent filter will automatically be created (filter by To or filter by From, for that particular email address)

By clicking the search button without any criteria added you always get the latest messages that are stored in the system.

Figure 4-1 Search tab contents (example)

To perform a Search, one or more filters must be added as search criteria.

When performing a search you need to provide at least one recipient or sender criteria.

Select the desired search criteria and click the add filter button to add the new criteria.

Figure 4-2 Adding a filter

The new criteria will be shown, under Active Filters, as seen in the next figure:

It is possible to narrow down the message results using multiple filters, although only one filter per each criteria type can be added. The following figure shows what a search with multiple criteria looks like.

Figure 4-3 Multiple criteria filter

Previously added filters can be removed by clicking the red cross sign on the left of the filter, or by clicking the clear filters button, which will remove all configured filters at once.

After setting up the desired search criteria, click the search button to perform the actual search operation. The results will be shown in the bottom part of the screen.

In case there are no records matching the selected criteria, a message specifying "No results" will show up in the results pane.


13

When performing a search, the following criteria is available:

Criteria Description

To The e-mail address of the receiver.

From The e-mail address of the sender.

From domain The e-mail domain of the sender.

From IP The IP address of the Server that delivered the message.

Subject The contents of the message subject line.

Time The Date and time the e-mail was received.

ClassificationThe final result that is applied to the message after all the filtering takes place.

ActionThe action that is applied to a message after all the filtering takes the place.

Table 4-1 Search criteria

4.1.1 “to” and “from” criteria

The to and from fields only accept an e-mail address as an option. For example [email protected].

You are only allowed to search for *@yourdomain.com addresses that belong to the domain you administer. In case you want to search for the messages that belong to a different domain you will receive the following message:

Figure 4-4 Error Message

4.1.2 “to domain” and “from domain” criteria

The to domain and from domain fields only accept an e-mail domain as an option.

4.1.3 “from ip” criteria

The from ip field only accepts a valid IPv4 address as an option, for example, 62.48.241.106


14

4.1.4 Subject criteria

The subject field accepts one or more strings of characters. There is a match if the specified strings occur in the message's subject line. No wildcards are allowed here.

4.1.5 Classification criteria

When selecting the Classification Search criteria, the following options are available:

Classification Description

Clean Mail that was accepted for delivery to its final destination.

Spam Mail that was found to be probable spam.

Highspam Mail that was found to be spam.

Infected Mail that contains virus, typically found in attachments.

PolicyblockedMail is classified as Policy Blocked when it triggers defined rules, e.g blacklists or attachment rules.

Notscanned Mail is bigger than a pre-defined size (by default this value is 256 Kb).

Table 4-2 Classification criteria

4.1.6 Action criteria

For the Action Search criteria the following options are available:

Action Description

Forwarded Mail that is forwarded to the final destination.

Discarded Mail that is removed from the system.

Table 4-3 Action Criteria

4.2 Search Results

The search results list is always sorted by date in descending order. It is possible to define the number of records displayed per page: the available options are twenty, fifty or one hundred records per page. The information displayed for each message that matches the search criteria is summarised in the following table:


15

Column Description

Date Date and time the e-mail was received.

From E-mail address of the sender.

To E-mail address of the receiver.

Subject Contents of the message subject line.

ReportThe reason for the action performed, such as a high spam score, the sender is on a blacklist or the message has been identified as a virus.

Action The action taken on the message.

Table 4-4 Search options

4.3 Message details

Click anywhere on a list entry to view that message's information in detail.

The message details will appear in a new internet browser tab.You may close this by clicking on the close window button.

The message details section is divided in two parts: message details and message headers.

Message details

The message details fields are described in the following table:

Detail Description

Date/Time The Date and time the e-mail was received.

From The e-mail address of the sender.

Recipient The e-mail address of the receiver.

Message Subject The contents of the message subject line.

Message Size The size of the message in bytes.

Mailer IP Address The IP address of the Server that delivered the message.

Scan Result The result given to a message after all the filtering takes place.

Table 4-5 – Message details fields


16

Options in Message details

In the message details part it is possible to carry out search queries with the From and Recipient IP address fields.

Selecting Search on the right of the From field will change to the Search tab and show all the messages that were sent from that Originator.

Selecting Search on the right of the Recipient field will change to the Search tab and show all the messages that were sent for that particular recipient.

While at Message details, you can add the From Address to the User’s Blacklist and Whitelist and to the domain’s Blacklist ahd Whitelist.

To add the From Address to Blacklists and Whitelists, just click on the drop down tab and then click on the desired option, as seen on the following figure:

Figure 4-5 Options within Message details

Message headers

Message headers (shown in screenshot below) show the message's complete e-mail headers. Analysing message headers can be helpful for troubleshooting purposes.

Figure 4-6 Header example


17

5 Setup tab

The settings available for the Setup option are:

• Anti-Spam displays the current spam score thresholds defined on the system and the status of the different anti-spam technologies (enabled or disabled). These technologies are: Heuristic filtering, Image analysis, Signature Database, Reputation Database and URI Database.

• Whitelist/Blacklist: displays the number of whitelist and blacklist entries that affect the selected domain

• Disclaimer: to create disclaimers to include inbound and outbound messages.

Figure 5-1 Example of setup view

5.1 Anti-Spam Settings

First, select the Users for which you would like to edit the anti-spam settings, or All Users to edit the default settings.

After domain and User selection, three forms will be shown: active engines, thresholds and actions.

5-2 Anti-spam configuration options

Use the thresholds options to define which messages are to be classified as spam.

After that, you can configure which action should be performed on each message, depending on its previous classification. When you finish setting up, click the Update settings button for your changes to take effect.


18

5.2 Whitelist

Whitelists enable you to guarantee the reception of messages based on the sender's address, domain, IP, networks or sender server hostname (PTR record).

Whitelists can be defined globally, for a particular Domain or User.

5-3 Whitelists/ Email example

5.2.1 Defining whitelists

Whitelists can be of type email or IP/CIDR. An explanation of the different types can be found in the following table:

Whitelist Type Description

Sender address Email The email address of the sender.

Sender Domain Email The email domain of the sender.

Whitelist Type Description

Sender IP IP/CIDRThe IP address of the Server that delivered the message.

Sender CIDR IP/CIDRThe network IP address of the Server that delivered the message.

Table 5-1 Whitelist options


19

The following formats are accepted for each of these fields:

Whitelist Accepted formats

Email

*@*

*@domain.tld

*[email protected]

abc*@domain.tld

abc@*

abc@dom*

abc@*domain.tld

Whitelist Accepted formats

IP/CIDR

x.x.x.x

xxx.xxx/xx

xxx.xxx.xxx/xx

xxx.xxx.xxx.xxx/xx

*

*.tld

*.domain.tld

*domain.tld

*.subdomain.domain.tld

Table 5-2 Whitelist accepted formats

To remove an entry, select it from the current list by clicking on it, then click remove.

The Ctrl and Shift keys can be used to select multiple entries from the list.

The order by which blacklist and whitelist rules are executed is as follows:

1. Blacklist IP/CIDR

2. Whitelist IP/CIDR

3. Email Blacklist

4. Email Whitelist.


20

5.2.2 Importing Addresses

It is possible to insert multiple addresses at the same time (one entry per line), by using Import File option. To do so, select the file which contains the address list after clicking browse, then click submit.

The email addresses, domains, IP/CIDRs and hosts to be added should be in the format explained in Whitelist accepted formats table.

5.2.3 Exceptions

The exceptions mechanism was designed to provide a quick way to create exceptions to the whitelist. It works in a similar manner to update whitelist.

Whitelist Target Email, IP/CIDR Type

GLOBAL The email address of the sender. Email

[email protected] The email domain of the sender. Email

[email protected] IP address of the Server that delivered the message.

IP/CIDR

Table 5-3 Whitelist Samples

It is possible to add any exception type (Email, IP/CIDR) to both email and IP/CIDR whitelists; for example, if your organization wants to accept all email from the domain customer.com except if the email is sent from a particular network, such a rule can be specified in the Exceptions section.

5.3 Blacklist

Blacklists enable blocking the reception of messages based on the sender's email address, domain, IP address, networks or sender server hostname (PTR record).

Blacklists can be defined globally, for a particular domain, group or User.

5.3.1 Defining Blacklists

To create a blacklist for all Users in a domain, on the field USERS select All Users.

To edit the blacklist settings for an existing User select that User domain and then select the User.

To create blacklist settings for a User that does not appear on the list, after selecting the domain select other User, enter the new User address and click select.

After selecting the blacklist target, the blacklist section will appear.

Blacklists can be of type email or IP/CIDR.

An explanation of the different types can be found in the following table:


21

Blacklist Type Description

Sender address Email The email address of the sender.

Sender Domain Email The email domain of the sender.

Blacklist Type Description

Sender IP IP/CIDR The IP address of the Server that delivered the message.

Sender CIDR IP/CIDRThe network IP address of the Server that delivered the message.

Table 5-4 Whitelist options

The following formats are accepted for each of these fields:

Blacklist Accepted formats

Email

*@*

*@domain.tld

*[email protected]

abc*@domain.tld

abc@*

abc@dom*

abc@*domain.tld

Blacklist Accepted formats

IP/CIDR

x.x.x.x

xxx.xxx/xx

xxx.xxx.xxx/xx

xxx.xxx.xxx.xxx/xx

*

*.tld

Table 5-5 Blacklist accepted formats


22

To remove an entry, select it from the current list by clicking on it, then click remove. The Ctrl and Shift keys can be used to select multiple entries from the list.

The order by which blacklists and whitelists rules are executed is the following:

1. Blacklist IP/CIDR

2. Whitelist IP/CIDR

3. Email Blacklist

4. Email Whitelist.

It is possible to insert multiple addresses at the same time, by using Import File option.

To do so, select the file which contains the address list after clicking browse, then click submit.

The email addresses, domains, and IP/CIDRs to be added should be in the format explained in the Table Blacklist accepted formats, one entry for each line.

5.3.2 Exceptions

The exceptions mechanism was designed to provide a quick way to create exceptions to the blacklist. It works in a similar manner to update blacklist.

Exceptions accepted formats are the same that are explained in table Blacklist accepted formats.

It is possible to add any exception type (email, IP/CIDR, hosts) to mail, CIDR/P and hosts.

For example, if your company wants to deny all email from the domain somecompany.com except if the email is sent from a particular network, such a rule can be specified in this section.

Blacklist Target Email, IP/CIDR, Hosts Type

GLOBAL The email address of the sender. Email

[email protected] The email domain of the sender. Email

[email protected] IP address of the Server that delivered the message.

IP/CIDR

Table 5-6 Blacklist Samples

5.4 Disclaimer

Disclaimers can be added to inbound or outbound email traffic.

To manage disclaimers use the Setup tab and access the disclaimer option.

For the domain, it is then possible to apply to all users or to a specific email address.

After dealing with the scope selection, the next step is to activate the disclaimer functionality and select on which direction the disclaimer should be applied

To edit the disclaimer settings for an existing user select that user domain and select the user.

After you select the user the Disclaimer settings screen appears:


23

Figure 5-4 Disclaimer,

The maximum size for the disclaimer is 8Kb.

It is possible to set a disclaimer for both inbound and outbound messages depending on whether you select the inbound or outbound tab above in the disclaimer details.

A summary of the disclaimer settings is shown in the following table:

Disclaimer Options Description

Activate Determines whether the disclaimer is attached to the messages

Text Disclaimer The disclaimer to be attached to text/ASCII-based messages

HTML Disclaimer The disclaimer to be attached to HTML-based messages

Table 5.7 – Disclaimer Options


24

6 Reports tab

Under the Reports section, you can configure periodic or one-time reports. These allow you to analyse what kind of email your email server receives, through graphical depictions of that data.

Figure 6-1 Example of reports view

You can send a report to a given recipient, by setting up the following parameters:

• Friendly Name: name for the report

• Scope: all domains /selected domains

• Run:

o now (immediate report);

o daily, weekly, monthly (scheduled report)

• Period: covered by report stats

• Data: data included on the report

• Recipient address: An email address for the report receiver.

You then must click generate to produce and send the report.


25

6.1 Schedule Reports and Current Schedule

It is possible to either generate a report on demand, or configure the system to automatically generate the reports on a daily, weekly or monthly basis.

The following table describes the report properties you can modify to increase the usefulness of your reports.

Option Description

FriendlyName

The name by which the report will be known to the User. This is not a unique identifier, rather its aim is to help the User identify the reports both when they are received and when they are shown in the Current Schedule pane. The criteria for choosing the friendly name is at the sole discretion of the User.

Timezone The local time set for the report.

Period

Data will be gathered for the time interval indicated here. For a one shot report (now) all the periods are available. For daily reports, the last 24 hours will automatically be selected. For weekly reports the last week will automatically be selected and, finally, if monthly report is selected, the last 30 days are automatically selected.

DataTypes of data to display in the report. In order to successfully schedule the report, at least one kind of data must be selected. The different data types correspond to the different kinds of graphics included in the reports.

Recipient address Email address to which the report will be sent

Table 6-1 Reports options

The period of the report (for example, the time interval for which data will be gathered) depends on the periodicity. For example, daily reports include data from the previous day, and similarly for weekly and monthly reports.

It is not possible to schedule yearly reports reports for the previous 12 months are available as one-time Domain Reports.

Current schedule displays a tabular layout showing detailed info of the report queue.

The reports shown here will be either one-shot reports waiting to be processed (for example, removed from queue and sent), or periodic reports, which remain on queue until manually deleted.

To delete a report, click on the delete link in the Actions column.

Vodafone Hosted Services: Mail Protection User Guide

26

Reports graphics

Figure 6-2 Domain Activity Report example

Alongside the report header is shown a table with the numeric totals for each of the message classes. A short description follows:

Option Description

Total Messages Received

Number of messages that were processed, for the given period. This excludes rejections.

Classified as Clean Number of processed messages that were classified as clean

Classified as Spam Number of processed messages that were classified as spam

Classified as Infected

Number of processed messages that were classified as infected

Rejected by User Policy

Number of messages rejected due to User policy settings

Rejected by Server Number of messages rejected due to server policy settings.

Table 6-2 Domain reports header table options


27

Graph Ham vs. Spam

The following chart shows the proportion of received legitimate (Ham) versus unsolicited (Spam) mail. If there was email blocked due to other reasons (e.g. virus), the corresponding percentage will be shown as well. One chart will be shown with the global stats of all domains in Scope.

Figure 6-3 Ham vs. Spam

Graph Message Classification

The following chart shows the number of messages grouped by their classification, on an interval basis. The data concerns all the domains listed in Scope.

Figure 6-4 Graph Message Classification


28

Graph Message Volume

The following chart shows the email message volume on an interval basis.

Figure 6-5 Graph Message Volume

Graph Volume vs. Messages

The following chart shows the email message volume plotted against the number of messages received, on a per time interval basis.

Figure 6-6 Graph Volume vs. Messages


29

vodafone hosted services hosted email anti-spam user guide · tagging the email involves either...

Documents