Spam detection and filtering at Deakin

Deakin's spam detection has been greatly enhanced with the introduction of a commercial spam and virus filtering appliance, IronPort, as an outer layer of spam defence. This device can perform up to five types of filtering on messages from external sources before they reach the Deakin mailserver.

How does spam and virus detection work?

The first level of spam and virus checking at Deakin takes place on messages before they reach the Deakin mailserver and has several stages:

The first level check is to identify if the message is from a reputable source and involves comparing the originating domain and/or IP address with a known list of spam sources and assigning a "reputation index" to the message.
The next level involves a context check including content and method of message construction.
Messages are then checked against a list of known viruses.

Messages "failing" any of these tests are not passed to the Deakin mailserver and will never be received.

The IronPort provides an added level of virus protection due to the fact that it is connected to similar devices around the world. These devices can recognise trends in messages that may indicate a developing virus. Suspect messages are held for a period of time to allow for the creation of an appropriate virus definition if necessary. If a virus is subsequently identified they never reach the Deakin mailserver, if not they are passed on at the end of the "quarantine" period.

Previously, ITSD employed software known as 'Spam Assassin' which would add extra information to spam messages headers, allowing spam filters to be created in both Webmail and Eudora. ITSD no longer employs this software so such filters are now unnecessary.

Reporting SPAM

Occasionally some SPAM may still sneak through. In these cases you can report SPAM using Webmail. You must report SPAM within 24 hours of receiving it. Other email software, such as Eudora, does not allow messages to be sent in the format required by the recipient but messages received in Eudora will still be available to you in Webmail and can be reported from there.