Configuring an Antispam Rule

Procedure

1. Go to Policies → Policy Management.
2. Click the Antispam Rules tab.
3. Do one of the following:
   • Click Add to create a new rule.
   • Click a rule name to change the settings.
4. Type a rule name.
5. Select the Spam, Graymail, or both message types and configure the scanning conditions.

   Message Type	Description
   Spam	Enables Deep Discovery Email Inspector to scan messages for spam based on the spam catch rate or detection threshold you specify. High: This is the most rigorous level of spam detection. Deep Discovery Email Inspector monitors all email messages for suspicious files or text, but there is greater chance of false positives. False positives are those email messages that Deep Discovery Email Inspector filters as spam when they are actually legitimate email messages. Medium: This is the default and recommended setting. Deep Discovery Email Inspector monitors at a high level of spam detection with a moderate chance of filtering false positives. Low: This is most lenient level of spam detection. Deep Discovery Email Inspector only filters the most obvious and common spam messages, but there is a very low chance that it will filter false positives. Specify a detection threshold: Type a threshold value (between 3.0 and 10.0) that represents how critically Deep Discovery Email Inspector analyzes messages to determine if they are spam.
   Graymail	Enables Deep Discovery Email Inspector to scan messages against the Email Reputation Services (ERS) score to identify graymail messages. Select one or more message categories that Deep Discovery Email Inspector considers as graymail. Note You can add the IP addresses or subnets of trusted senders to the Graymail Exceptions list. Email messages from IP addresses or subnets in the list bypass graymail scanning in Deep Discovery Email Inspector. For more information, see Adding a Graymail Exception.

6. Specify the Action.
   For more information, see Policy Actions.
7. (Optional) To send a blind carbon copy of detected messages to one or more recipients, type the recipient email addresses in the BCC field.

   Note You can specify up to 50 email addresses. Wildcard characters are not supported.

8. (Optional) From the Send notification drop-down list, select a notification message to inform recipients about the applied policy action.

   Important Deep Discovery Email Inspector only sends recipient notifications when you select Send notification and a notification message.

   You can configure notification messages on the Notifications screen (go to Policies → Policy Objects → Notifications).

   For more information, see Configuring Recipient Notification.
9. (Optional) From the Insert stamp drop-down list, select a stamp that you want to insert in to detected messages.
   For more information, see Configuring a Message Stamp.
10. Click Save.
    After adding a rule, you can:

    • Click a rule name to edit the rule settings.
    • Select a rule and click Delete to remove the selected rule.
    • Select a rule and click Copy to create a copy of the selected rule. You can edit the copied rule to create a customized rule.