| Step A: Check if something in the messages is excluded
( e-mail address, IP address, hostname, subject, text or white list ) If so, proceed with step D Step B: Evaluate all methods ( assuming the message is not excluded for that method ) and build a list of failed methods Step C: Calculate which action of the failed methods of step B has the highest
priority: | Method sorted by priority | Subject tag | Script shortcut | | | Address | [e-mail] | e-mail | | IP/Host | [ip] | ip | | DSN | [dsn] | dsn | | Subject | [subj] | subj | | Text | [text] | text | | HTML | [html] | html | | Attachment | [att] | att | | Exploit | [expl] | expl | | MS Office with Macro |
[msvba] | msvba | | MS Office with Password | [offpass] | offpass | | MS Office with ext mismatch | [offext] | offext | | Mailing List | [maillist] | maillist | | CCS | [ccs] | ccs | | Phishing | [phishing] | phishing | | SaneSecurity | [sanesec] | sanesec | | SLS/RBL | [sls] | sls | | Country | [cty] | cty | | Bayes | [bayes] | bayes | | Heuristic | [heur] | heur | | Header | [hdr] | hdr | | BCC | [bcc] | bcc | | Internal From |
[internal-from] | internal-from | | Faked From | [faked-from] | faked-from | | Faked MX | [mx] | mx | | FCrDNS | [iprev] | iprev | | SPF | [spf] | spf | | DKIM | [dkim] | dkim | | GURBL | [surbl] | gurbl | | SURBL | [surbl] | surbl | | Image | [img] | img | | Charset | [charset] | charset | | Auto IP | [auto-ip] | auto-ip | | Senderbase | [senderbase] | senderbase | | Backscatter | [backscatter] | backscatter | | Bitcoin |
[bitcoin] | bitcoin | | SecuriteInfo | [secinfo] | secinfo | | MS Office with Macro | [olevba] | olevba | | Community Rules | [comrule] | comrule | | DisplayName From | [dispf] | dispf | | DisplayName To | [dispt] | dispt | | DisplayName CC | [dispc] | dispc | | Sublime E-Mail Reputation | [ser] | ser | | S/MIME | [smime] | smime | | User Defined Method | [udm] | udm | | Absolute Block | [abs] | abs | Action sorted by priority:
- Discard message - (0)
- Send a non-delivery report to the sender - (4)
- Encapsulate and forward to Postmaster - (1)
- Forward to Postmaster - (6)
- Encapsulate and send to recipient - (2)
- Encapsulate and send to recipient without attachments - (3)
- Mark subject and move to Junk-E-Mail folder - (5)
- Mark subject - (7)
- Forward to recipient - (8)
If the action is Discard message or Send a non-delivery report to the sender then proceed with step E, else proceed with step D Step D: Scan the message for a virus.
If the message has no virus or there is no virus scanner available, then send the message to Exchange Step E: Perform the action that was calculated in step C |