Introduction to IronPort Spam Quarantine IronPort Systems is a world-class provider of email security solutions including a highly accurate spam filtering product. MCOE Technology and Information Services (TIS) has deployed IronPort s Spam Quarantine, a feature that stores and provides access to your spam email messages. It will allow you to easily review your messages and in the rare event of a false positive a message incorrectly marked as spam it will provide a link to immediately release the message to your inbox. Figure 1. IronPort Spam Quarantine Notification 1. Greeting message 2. Click here to view all of your held messages 3. Click here to release this message 4. Click here to view this message. Details of the IronPort Spam notification The IronPort Spam Quarantine notification is an email message sent to you by the quarantine system that lists the spam messages received since your last notification. Notifications may be sent daily based on the settings set by your administrator. The notification has several parts: 1. A greeting, providing general instructions about the notification. Your greeting may differ from the text here and may include your company s logo.
2. A link to the web interface of the IronPort Spam Quarantine. This link will take you to a web page that displays all of the held messages. (See Figure 2.) The next section of the notification is a list of the messages that have been marked as spam by the IronPort system. Each row represents a single message and the Sender, Subject, and Date of the message is displayed. 3. The Not Spam link can be clicked to release a message. If you decide that a message is NOT spam, based on the sender and the subject, clicking this link will cause the quarantine to immediately release the message. It will be delivered to your inbox as normal. 4. The Subject of each message is a link that will display the individual message in the spam quarantine web interface. (See Figure 3.) Figure 2. IronPort Spam Quarantine interface. 1. Message list 2. Release the message 3. Delete the message, permanently 5. Search Box 6. Navigation tools 4. Message check box When you click on the your email quarantine or View all quarantine messages links in the Spam Quarantine notification, you are taken to a web page that allows you to view, delete, or release spam messages.
The interface has a number of features (Figure 2) to let you manage the messages stored: 1. List of all messages 2. Not Spam button. When active, click to release the selected messages to your Inbox. 3. Delete button. When active, click to permanently delete the selected messages. 4. Check box next to each message in the list. Selecting a check box activates the Not Spam and Delete buttons. 5. A search box that will allow you to search messages by sender or subject. The Advanced Search link allows you to search with more criteria including a date range. 6. Navigation tools allow you to jump to other messages and display more per page, if there are more than 25 messages in the quarantine. Figure 3. Spam details page 1. Message controls 2. Sender details 3. Message content.
When you click on the Subject of a message in either the Spam Quarantine notification, or in the Spam Quarantine web interface, details of the message are displayed. The message display has several parts (Figure 3): 1. Not spam and Delete buttons which will release the message, or permanently delete it, respectively. 2. Sender and recipient details. 3. Actual message content. For security reasons, only a portion of the message body is displayed in plain text. Plain text display prevents the message from using scripts, tracking images, or other malicious content from harming your computer. To display the full contents of the message in its original form you must release the message with the Not Spam button.
Using End User SAFELISTS and BLOCKLISTS End users can create safelists to ensure that messages from specified senders are never treated as spam, and they can use blocklists to ensure that messages from specified senders are always treated as spam. For example, an end user might receive unwanted email from a mailing list. The user can add this sender to the user s blocklist to prevent email messages from the sender from being delivered. On the other hand, an end user might find that email messages from a legitimate sender are sent to the IronPort Spam Quarantine, but those email messages should not be treated as spam. To prevent mail from that sender from being quarantined, the user can add the sender to the user s safelist. Note Safelist/blocklist settings are contingent on other settings configured by the system administrator. For example, a safelisted message may not be delivered if it is determined to be virus positive, or if the administrator determines that the content does not conform to company email policies. Accessing Safelists and Blocklists To access safelists and blocklists, end users whose accounts are authenticated using LDAP or mailbox authentication (IMAP or POP) must log in to their accounts on the IronPort Spam Quarantine. The end users must log in to their accounts even if they are accustomed to accessing messages through a spam notification (which typically does not require LDAP or mailbox authentication). If the end user authentication is set to None, end users do not need to log in to their accounts to access safelist/blocklist settings. Adding Entries to Safelists and Blocklists Entries can be added to safelists and blocklists using the following formats: user@domain.com server.domain.com domain.com End users cannot add a sender or domain to both their safelist and their blocklist at the same time. However, if they add a domain to a safelist and a user in that domain to the blocklist (or vice versa), the IronPort appliance applies both rules. For example, if the end user adds example.com to the safelist, and adds george@example.com to the blocklist, the IronPort appliance delivers all mail from example.com without scanning for spam, but it treats mail from george@example.com as spam. End users cannot allow or block a range of subdomains using the following syntax:.domain.com. However, an end user can explicitly block a specific domain using the following syntax: server.domain.com.
Working with Safelists End users can add senders to safelists in two ways. From the IronPort Spam Quarantine, they can manually add a sender to the safelist by clicking the Options menu in the upper-right corner of the GUI and then selecting Safelist. Safelist in End User Quarantine Add an email address or domain to the list, and click Add to List. End users can also add senders to the safelist if the message has been sent to the IronPort Spam Quarantine. If the message from a particular sender is held in the IronPort Spam Quarantine, the end user can select the check box next to the message, and choose Release and Add to Safelist from the drop-down menu.
Safelist in End User Quarantine The envelope sender and the From header for the specified mail are both added to the safelist, and the released messages proceed directly to the destination queue, skipping any further work queue processing in the email pipeline. Note End users can also use the spam notification message to release messages. Click the Not Spam link to release a particular message. End users also have the option to add senders to their safelists.
Working with Blocklists End users can use blocklists to prevent the delivery of mail from specified senders. To add senders to a blocklist, the end user selects Options > Blocklist from the end user quarantine. Adding Senders to a Blocklist From the end user quarantine, the end user enters an email address or domain in the field, and clicks Add to List. When the Email Security appliance receives mail from the specified email address or domain that matches an entry in the blocklist, it treats the mail as spam. The mail might be deleted or quarantined, depending on the blocklist action setting.
Frequently asked questions 1. I m not receiving any spam notifications. Why? The system will not send a notification if there are no spam messages received since the previous notification. Your administrator will set the frequency of these notification emails. 2. Why am I getting multiple notifications? Your administrator may have installed more than one quarantine system and each is sending a notification of messages it has stored. If you have or use more than one email address, you may also receive notifications for each of these email addresses. 3. I still have an old notification email. Can I use this old notification to manage spam messages? Yes. Any notification received can still be used to manage messages, or to navigate to the web interface of the spam quarantine. 4. Do I need to delete messages that are spam? No. Messages that are spam do not need to be deleted. The system will automatically delete older messages, typically those older than 14 days. You will not receive notification of messages that have been listed in a prior notification. 5. Can I review older messages? Yes. You can review any messages held in quarantine that have not yet been automatically delete due to age. Click on the your email quarantine or View All Quarantined Messages link in the notification. 6. I attempted to release a message but reached an error page that says, This message was not found. It may have been released or deleted. I have never released or deleted this message. What happened? If a spam message was delivered to a mailing list address, the notification will be delivered to all the email addresses on that mailing list, and any user with the notification can release or delete the message.