ITS Mailfilter

Grinnell College ITS has deployed the IronPort spam appliances at the gateway.

The IronPort appliances use the SenderBase Network to identify known spam sources, and will block messages coming from such sites at the gateway.

Messages that are not identified as coming from known spam sources are still additionally scrutinized for spam content, and any messages that are identified as spam will be handled according to the mail flow group you have chosen to be part of. The 4 possible mail flow groups are:

1) DEFAULT: messages that are positively identified as spam will be blocked, and messages that are identified as being possible spam will be tagged with [SUSPECT SPAM] in the subject line and delivered to your inbox.

2) Quarantine Box with messages identified as suspected spam being quarantined on the mail appliance, and messages being identified as positive spam being blocked. Daily messages alerting users to new quarantine messages will be sent to the user (provided a new message has been quarantined during the 24 hour period). This option also adds on the ability for the user to have a safelist/blocklist feature at the gateway.

3) Quarantine Box with messages indentified as both positive and suspect spam being quarantined on the mail appliance. Daily messages alerting users to new quarantine messages will be sent to the user. This option will likely result in a high number of messages being quarantined daily, but is the option for users wanting to see every message being identified as spam, yet not having any of those messages being delivered to the user's inbox. This option also adds on the ability for the user to have a safelist/blocklist feature at the gateway.

4) No spam scoring action performed for the user at all. Messages that would have been identified as positive or suspected spam will not be tagged, and will be delivered to the user's inbox. This option will result in spam reaching the user's inbox, but is offered as an option for any user not wishing the spam appliance to do any spam scoring beyond the SenderBase Network scoring.

All users will be set with Option 1. If you wish to stay with this option, no further action will be required of you. If you wish to be set with another mail flow option, you may email postmaster@grinnell.edu with your choice of mail flow group you would like to be placed in.

If you are asking to be placed in group 2 or 3, then the remainder of this web page should be referenced for additional information.

All of the features mentioned from this point on are only available if you are in option group 2 or 3. While users in option group 1 or 4 will be able to access the quarantine area and the Safelist/Blocklist areas, no messages will ever be quarantined for the user, and the Safelist/Blocklist is only active for users with the quarantine feature on (mail flow option groups 2 and 3).

How do I log in to mailfilter?

What will my quarantine screen show me?

What are my options for messages that have been quarantined?

How will I know if I have quarantined messages?

How long will quarantined messages be kept?

How do I add senders to my Safelist or Blocklist?

How do I bring over my Whitelist/Blacklist from the old mailfilter to the new system?

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------

You can logon to the ITS Mailfilter web page at:https://mailfilter.grinnell.edu

Login using your network username and password

If you have do not have any messages in your quarantine box, your screen will look like this:

 

 

If you have messages in your quarantine box, it will look like this:

With messages in your quarantine box, you will be able to select each message individually (see screen shot above), and perform the following actions noted . Release will simply release the message this one time to your inbox. Release and Add to Safelist will also add the email address to your Safelist, which will ensure any messages coming from this email address will not be quarantined in the future. Delete will delete the message from your quarantine box.


You can also select all messages in your quarantine box, and perform the action on every message in your quarantine box (this is useful when you would like to delete all of the messages as once). Click the box to the left of the From heading, and this will auto-select all messages, and then you can choose to perform the action on all of the messages.

The IronPort appliances will email a report of any new messages that have been quarantined for the past 24 hours each day at 3 pm.

The email will look like this:

From this email message, you may click on the Not Spam button by each message in the email to have this message immediately delivered.

Please note that this message will only show the messages for the last 24 hours, not all messages that are possibly in your quarantine area.
To see all messages that may be in your quarantine box, click on the link View All Quarantined Messages.

Messages in your quarantine folder will be kept for a maximum of 30 days. Messages older than 30 days will be deleted automatically.

The Safelist/Blocklist feature is accessed via the Options button to the top right of the screen.

Users added to your Safelist will not be subject to Spam scoring. Please note that these messages are still subject to the initial SenderBase Network scoring, and if the sending IP is identified as a known spammer, the message will still be blocked. This will cut down on spammers using the email address of someone you have Safelisted flooding your inbox.

Users added to your Blocklist will simply be blocked, and no further messages from that email address will be delivered to your inbox.

For either the Safelist or Blocklist, you may add a single email address in the form of user@domain.com or add an entire domain in the form of bad.domain.com (to Safelist or Blocklist only messages coming from that sub-domain) or domain.com to Safelist or Blocklist that entire domain.

Safelist:

Blocklist: