Environment

Netmail Secure 5.4.x and later releases

Synopsis

With the release of Netmail Secure 5.4, Netmail simplified the information presented in the headers regarding items deemed to be SPAM.

The tag X-MplusSpamScore: has been made obsolete by the X-MplusEngineMask.

Details

SPAM3:

LevelDefinition
0Not Spam
1Never Seen
2Unused
3Bulk
4Spam


SPAM4:

CategoryDefinition
1Sender Spammy Reputation
2URL Spammy Reputation
3HTML Formatting
4Spam Tricks: Obfuscation
5HTML Image Spam
6URL formatting hosting service domain
7Spammy keyword Stocks
8Spammy keyword Porn
9Spammy keyword Drugs
10Spammy keyword Loans
11Spammy keyword Degrees
12Spammy keyword Software
13Spammy keyword Dating
14Spammy keyword Free stuff
15Spammy keyword Advance Fee Fraud
16Spammy keyword Marketing
17Spammy keyword Lottery
18Spammy keyword Internet Business
19Email header inconsistency

20

Virus
21Phish
22Replica
23Generic spam indicator
24Ham indicator
25Other


SPAM5:

LevelDefinition
1SPAM
2Virus
3Bounces
10Mainstream Newsletters
11Miscellaneous Newsletters
12Bad Newsletters
13Social Media

X-MplusEngineMask Values:

 

BitsValueMeaning
0000 00000None
0000 00011SPAM5
0000 00102DBL/URIBL/etc (SURBL Agent)
0000 01004SPAM3
0000 10008SPAM4
0001 000016AntiMasking / Anti Spoofing
0010 000032ZetaScan
BitsValueMeaning
0000 00113SPAM5 + URIBL
0000 01015SPAM5 + SPAM3
0000 01106URIBL + SPAM3
0000 01117SPAM5 + URIBL + SPAM3
0000 10019SPAM5 + SPAM4
0000 101010URIBL + SPAM4
0000 101111SPAM5 + URIBL + SPAM4
0000 110012SPAM3 + SPAM4
0000 110113SPAM5 + SPAM3 + SPAM4
0000 111014URIBL + SPAM3 + SPAM4
0000 111115SPAM5 + URIBL + SPAM3 + SPAM4
0001 000117SPAM5 + AntiSpoof
0001 001018URIBL + AntiSpoof
0001 001119SPAM5 + URIBL + AntiSpoof
0001 010020SPAM3 + AntiSpoof
0001 010121SPAM5 + SPAM3 + AntiSpoof
0001 011022URIBL + SPAM3 + AntiSpoof
0001 011123SPAM5 + URIBL + SPAM3 + AntiSpoof
0001 100024SPAM4 + AntiSpoof
0001 100125SPAM5 + SPAM4 + AntiSpoof
0001 101026URIBL + SPAM4 + AntiSpoof
0001 101127SPAM5 + URIBL + SPAM4 + AntiSpoof
0001 110028SPAM3 + SPAM4 + AntiSpoof
0001 110129SPAM5 + SPAM3 + SPAM4 + AntiSpoof
0001 111030URIBL + SPAM3 + SPAM4 + AntiSpoof
0001 111131SPAM5 + URIBL + SPAM3 + SPAM4 + AntiSpoof
0010 00032ZetaScan

 

Spam Header Example 1:

X-Mplus-Spam-Scanned: mplusversion: 5.4.5.26-debug; timestamp: Fri, 05 Feb 2016 15:27:25 -0500
                engine: XCFSPAM3 Engine; version: 8.00.0106; level: 1
                                ref: str=0001.0A020201.56B505D6.024A,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
                                status: success;error: none
                engine: XCFSPAM4 Engine; version: 8.0.2/2016.02.05.10.19.59/2005.02.11.04.44.13/; level: 99
                                ref: 1 22, 4 30, 19 48
                                status: success;error: none
X-MPlusSpamScore: 3
X-MPlusEngineMask: 4 (Value 4 is 0100, so only SPAM engine 4 caught this as spam)

Spam Header Example 2:

X-Mplus-Spam-Scanned: mplusversion: 5.4.5.26-debug; timestamp: Fri, 05 Feb 2016 15:57:31 -0500
                engine: XCFSPAM3 Engine; version: 8.00.0106; level: 4
                                ref: str=0001.0A020206.56B50CDC.0132,ss=1,re=0.000,recu=0.000,reip=0.000,pt=F_4810712,cl=4,cld=1,fgs=0
                                status: success;error: none
X-MPlusSpamScore: 5
X-MPlusEngineMask: 8 (Value 8 is 1000, so only SPAM engine 3 caught this as spam)

Spam Header Example 3:

X-Mplus-Spam-Scanned: mplusversion: 6.0.0.1438630642-debug; timestamp: Fri, 29 Jan 2016 11:25:56 -0500
                engine: XCFSPAM4 Engine; version: 8.0.2/2016.01.29.08.41.51/2005.02.11.04.44.13/; level: 99
                ref: 1 100
                status: success;error: none
                engine: XCFSPAM3 Engine; version: 8.00.0106; level: 4
                ref: str=0001.0A090205.56AB9215.001D,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8
                status: success;error: none
                engine: XCFSPAM5 Engine; version: Vade Retro 01.387.06#88 (01.386.00) AS+AV+AP+RT Profile: NETMAIL,VRUnsubscribe; Bailout: 300; level: 1
                ref:                                         gggruggvucftvghtrhhoucdtuddrfeekjedrtdeigdekkeculddtuddrfeekiedrtddtmdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfpgffvofetkffnpdggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddtnecujfgurhcuheduuddtucdlvddttddmnedhkfhnvhhishhisghlvgcufihorhgushculdehtddmnegfrhhlucfvnfffucdlqdehmdenoggfufdqpfefjeelqdegieculdeftddtmdenucfjughrpefvkffhufhrgggtffesrgdttdfotddtvdenucfhrhhomhepofeutecuuggvghhrvggvuchophhtihhonhhsuceoufgrrhgrhhesfihgihhhohhtvghlrdgtohhmqeenucffohhmrghinhepfihgihhhohhtvghlrdgtohhmpdgslhhsrdhgohhvpdgvugdrghhovhenucfrrghrrghmpehhvghlohepughurhgrnhhothhitgguohhorhdrfihgihhhohhtvghlrdgtohhmpdhinhgvthepudeivddrvddugedrvddurdejjedpmhgrihhlfhhrohhmpeeolfgvrhgvmhhirghhofhilhhlshesughurhgrnhhothhitgguohhorhdrfihgihhhohhtvghlrdgtohhmqecuuefqffgjpeekuefkvffokffogfdprhgtphhtthhopeeouggrnhesghifthhoohhlshdrtghomheq/545/Unsub=http://rex.wgihotel.com##To=<dan@gwtools.com##ReplyTo=<Sarah@wgihotel.com##From=MBA degree options <Sarah@wgihotel.com##
                status: success;error: none
X-MPlusSpamScore: 9
X-MPlusEngineMask: 13 (Value 13 is 1101, so SPAM engines 3,4,5 caught this as spam)