ReputationAuthority/DNSBL/UBL timeout setting. Watchguard XCS

Intercept Anti-Spam

Item pbmf ipr trusted ts bs ubl bsctr dfp

Description

Pattern Based Message Filters

Mail Anomalies checks

Trusted or non-trusted

Trusted Senders List

Blocked Senders List

URL Block List check

Backscatter Detection

Document Fingerprinting

ReputationAuthority/DNSBL/UBL timeout setting

ReputationAuthority, DNS Blocks lists, and URL Block Lists, if enabled, perform their own separate checks per message when scanning messages for spam. In the event that one or more of the specified services are unavailable, the query to the service domain will time out.

The following options allow the administrator to configure the timeout and retry settings for each lookup query. It is recommended that the system defaults be used. If a query for ReputationAuthority, DNS Blocks

Lists, or URL Block Lists exceeds the timeout and retry threshold, the checks for this message will be skipped for that feature.

ƒ Timeout — Delay (in seconds) between each retry in the event of a ReputationAuthority/DNSBL/UBL lookup failure for a message. The default is 5 seconds.

ƒ Retries — Enter the number of retries to perform in the event of a ReputationAuthority/DNSBL/UBL lookup failure for a message. The default is 1 retry.

172 WatchGuard XCS

Intercept Anti-Spam

Intercept Components

Each component of the Intercept Anti-Spam engine can be enabled or disabled depending on your requirements.

To configure the settings for each feature:

1. Select the Enable check box for a specific feature.

2. Select the spam feature link to review or customize the default settings.

3. When finished, click the Apply button to save the configuration.

Each Intercept Anti-Spam feature is discussed in more detail in the following sections.

User Guide 173

Intercept Anti-Spam

Spam Words

The WatchGuard XCS provides a Spam Words dictionary filter. When enabled, all inbound messages passing through the system are scanned for words and phrases that appear in the spam words dictionary. Messages with words or phrases in their subject or body that match the phrase list are more likely to be spam. The

Intercept Anti-Spam engine will use this information to help decide if the message is spam or legitimate mail.

The system includes a basic pre-configured spam words list that can be used for message filtering.

WatchGuard’s default list includes basic words most commonly found in spam, such as “prescription” and

“viagra”. The full default list can be viewed and modified. Administrators can use this list to build and upload their own custom spam word list.

It is recommended that administrators review this default spam words list to ensure any included words are not part of their organizations functions. For example, the word “prescription” should be removed if the company is involved with the pharmaceutical industry.

To configure Spam Words:

1. Select Security > Anti-Spam > Anti-Spam .

2. Select Spam Words .

174

3. Select the Enable Spam Words check box to enable the Spam Words feature.

4. Select the type of Logging for messages that contain matched spam words and phrases.

This logging information will appear in the Mail Logs . Choose from the following:

ƒ No logging — No logging will be performed.

ƒ First match only — Only the first matching word will be displayed.

ƒ All matches — All matched words will be displayed.

5. Enter the Weighted Threshold value for weighted spam words dictionaries.

If using a weighted spam dictionary, the terms and their weight in the dictionary must match or exceed this threshold to classify a message as spam. If both weighted and unweighted dictionaries are used, the final action will be triggered if the sum of the weights exceeds the configured weighted threshold,

or if a match occurs in an unweighted dictionary. See “Weighted dictionaries” on page 159 for more

details on weighted dictionaries.

6. Select the Spam Words Dictionaries to be used for anti-spam checks.

The dictionaries available are listed in the Available Dictionaries list. Use the arrow buttons to move the dictionaries to the Dictionaries in Use list as required. This can be the Default Spam Words list provided by WatchGuard, or a custom list uploaded via Security > Content Control > Dictionaries & Lists . See the following section for more information on adding a custom dictionary.

WatchGuard XCS