Spam and Virus Filter README

The TZO Spam and Virus Filtering (SVF) service helps defend your mailserver against mailserver hacks, annoying spam and and dangerous email viruses. When you configure the SVF service, all email going to your mailserver will first pass through TZO servers. This means you can shield your mailserver from direct exposure to the Internet. TZO SVF will block most spam by scanning the IP address reputation of the sender, and then scanning the email content for spam and viruses.

SVF will block known spammer IP addresses, and benign-looking emails containing spamvertised web links. Email content is scanned using SpamAssassin, and emails with very high spam scores are automatically stopped. Emails which are on the edge of spam will be tagged with a custom mail header (and optionally, Subject: tagging) so you can quarantine these emails for human review.

Because all incoming email passes through the TZO SVF mailservers, you may take additional steps to secure your SMTP port from the Internet: whitelist the TZO servers in your email server and/or firewall, then block all other Internet IP addresses from connecting to your mailserver port 25. This configuration prevents several kinds of abuse.

Using the SVF service will require editing of your DNS MX record, setting it to svf.tzo.com. You should not specify a secondary MX record.

Once you configure SVF as your domain's MX, your mailserver will receive an increase in connections from the TZO SVF mailservers (as all incoming email will be relaying through SVF). Be sure you whitelist the TZO SVF servers. To your benefit you can configure mailserver or rules which would disallow SMTP connections from any Internet IP except that of SVF (so no spammers can discover your mailserver address and spam it directly). See SVF HOWTO document for details.

Anti-virus is always enabled. TZO SVF uses the popular SpamAssassin server to score emails, which will assign a score based on how confident the system is that the message is spam (higher scores indicate higher probability of spam).

The SVF management panel offers the ability to safely refuse (blackhole) messages which receive a very high spam score, and your server will never see these messages.

At a lower spam score level (above 0 points but below the Spam Refuse score) you can configure "tagging" of suspected spam. Please note that mail above the Tagged Spam score is not always spam -- some newsletters, invoices, or marketing emails could score high enough. It is important to not automatically delete these messages, but perhaps quarantine these on your mailserver (so they do not land in the user's Inbox) and task someone with reviewing the quarantined email daily.

As needed you can raise the level at which Spam Tagging occurs, making the tagging less likely to happen. Also you can exempt (whitelist) preferred senders. If you find some valid email is tagged as Spam, you could raise the Spam Tagging score by an additional point (less likely to tag). If you find your Spam folder to be large and never containing any accidentally tagged (non-spam) email you can also lower the Spam Refuse score by one point.

Even if your mailserver is not equipped with a sophisticated anti-spam feature, your mailserver will still contain "rate-limiting" and anti-abuse functionality. For example, every mailserver will have a policy for maximum number of connections per hour from an outside IP address, or maximum number of failed addresses or spam per sender IP.

Because 100% of your email will be arriving from the SVF server IPs, you should audit which of your email server's settings might affect TZO SVF delivery (if unsure, contact your email software support, and ask 'what changes are needed if you use an external mail filtering and relay service?'). Be sure to disable any graylist or tarpitting features. To whitelist the SVF servers, please see the SVF Howto for current IP addresses.

The TZO Spam and Virus Filtering (SVF) and TZO Store and Forward (SAF) services are similar in that they both provide equal anti-spam and anti-virus capabilities.

The SAF service includes additional features such as alternate-port delivery (works around blocked inbound port 25), and message queuing (holds your email if your mailserver goes offline, avoiding email bounces). This additional functionality is available with a service upgrade from SVF to SAF.