SpamFilter - DIA Reputation Filter and Real-Time Blacklist
Overview
eSoft's Distributed Intelligence Architecture (DIA) is a powerful new technology that adds higher levels of security intelligence, more powerful and detailed reporting, as well as ultra-rapid security updates to eSoft's field-based security appliances. DIA leverages the patented SoftPak Director (SPD) security infrastructure to create a dynamic, two-way communication channel between the appliances and the SPD. DIA Reputation Filter and DIA Real-Time Blacklist are two SpamFilter features which take advantage of the DIA framework to help eliminate Spam messages.
DIA Reputation Filter
DIA Reputation Filter keeps track of the Spam score and source IP address of email messages that are seen throughout the Internet. When an email message is scanned for Spam by your unit the average Spam score (or reputation) as seen by the DIA Reputation Filter is applied to the message on your unit.
DIA Real-Time Blacklist (RBL)
DIA Real-Time Blacklist (RBL) work in a similar manner as DIA Reputation Filter. A Blacklist is an IP address that appears to clearly be a source of Spam. If a source IP has a particularly high reputation score for an extended period of time then the IP is added to a Blacklist. By enabling 'Reject from DIA Real-Time Black List' the SpamFilter will reject any message from IP addresses found in DIA's RBL. This reduces the need to process these messages through the SpamFilter engine and reduces the overhead on your unit.
Configuration
Configuring DIA Reputation Filter or Real-Time Blacklisting is a very simple 'check to enable' process. Click Settings under the SpamFilter menu to load the main SpamFilter settings page. Next, click the Advanced button to reveal the DIA Settings. Check the features you wish to enable and click the Apply button to save your changes.
Troubleshooting
In the scenario where all of your mail comes from, or appears to come from, a single IP address or server, it may appear to the DIA Reputation Filter that this IP address is a major source of spam. To work around this, go to SpamFilter -> Settings -> Advanced. Enable the option 'All Mail Comes From One Server' and enter this servers IP address. When a value is entered in this box, the SpamFilter and DIA Reputation filters will ignore this IP address when it is the top (most recent) header of incoming message. The next address in the mail header will be used instead to correctly filter the messages.
If eSoft has Blacklisted an IP address it will be automatically removed when the IP's reputation falls below a dangerous level. If you need to immediately allow emails from this Blacklisted IP address you can enter the IP into the SpamFilter Whitelist. Keep in mind that this will stop Spam scanning for all emails coming from this IP address and may allow Spam or Malicious emails into your network. Follow the link below for detailed instructions on this process.
http://www.esoft.com/support_docs/AllowDIARBL.pdf
