Spam, Virus, and Outbreak Filtering
This domain tests configuration of the scanning layers that decide whether a message is delivered, quarantined, or dropped: anti-spam scoring, anti-virus engines, AMP file reputation and analysis, outbreak filters, and graymail handling, all bound to mail policies.
Core rules
- Anti-spam returns a score; positive scores indicate spam, negative scores indicate likely legitimate mail. Each mail policy sets its own thresholds, so a stricter threshold means more aggressive blocking. Actions are deliver with headers added, quarantine, or drop.
- Anti-virus scanning uses the enabled engines and is limited by which attachment types you scan; encrypted or unscannable attachments need an explicit handling decision.
- AMP adds file reputation from Talos and sandboxed file analysis, with retroactive verdicts when a file is later found malicious.
- Outbreak Filters apply predictive rules from Talos plus adaptive rules based on message characteristics, sending messages to an outbreak quarantine for a configurable retention period. They catch fast-moving campaigns before signature-based anti-virus catches up.
- Graymail detection separates bulk marketing and social notifications from true spam, optionally honoring unsubscribe requests.
- Mail policies match recipients; the default policy applies when no other policy matches.
Worked example
A finance team wants maximum protection. Create a mail policy for that group with a lower anti-spam threshold than the default, spam quarantine as the action, anti-virus and AMP enabled for all scannable attachments, and outbreak quarantine retention extended beyond the default. Before saving, confirm the spam and outbreak quarantines exist, since an action cannot reference a quarantine that has not been created. Test with the built-in spam test address and confirm the message lands in the expected quarantine rather than being dropped, so a false positive can be released.
Traps
- Reading scores backwards: a very negative score is not spam, and lowering the threshold increases false positives.
- Selecting a quarantine action before creating the quarantine.
- Assuming a per-recipient policy applies based on sender; matching is by recipient.
- Expecting AMP to scan file types you have not enabled.
- Dropping on outbreak rules instead of quarantining, leaving no recovery path for legitimate bulk mail.