Proofpoint Spam Control

Spam Control is a service that reduces the amount of spam you receive and eliminates known viruses before they reach your mailbox. As soon as you have a NetID you are automatically enrolled in the service.

Is it real email, spam, or a virus?

Spam Control uses a scoring system to determine if an incoming email sent to netid@uis.ed is legitimate email, spam, or virus-infected. Depending on its score, the email is regarded as one of the following:

• Not Spam: The email is legitimate correspondence.
• Possible Spam: The email has questionable characteristics but could be legitimate.
• Likely Spam: The email is probably spam.
• Certain Spam: The email is definitely spam.
• Virus: The email contains a known virus.

You can find detailed information about how email messages are evaluated on the Spam Control Scoring System page.

Choosing how your spam is handled

You can choose one of five different ways for Spam Control to handle possible, likely and certain spam. (Messages containing viruses are immediately deleted, and legitimate email messages [Not Spam] are delivered to your mailbox, regardless of which preference you select.)

The five ways for handling likely and certain spam are referred to as Personal Spam Policies. They are:
[NOTE: Cautious Plus is the default policy for all users. When you login to the Proofpoint Portal you may see something different list next to Default Policy, the portal does not correctly reflect the what has been applied to all users.]

• Cautious: Possible, likely and certain spam is sent to your Quarantine, a server space where spam is held for 10 days.
• Cautious Plus: Possible and likely spam is sent to your Quarantine, certain spam is automatically deleted.
• Aggressive: Possible spam is sent to your Quarantine; likely and certain spam is automatically deleted.
• No Quarantine: Possible spam is delivered to your mailbox; likely and certain spam is automatically deleted.
• Cautious Plus, No Quarantine: Possible and likely spam is delivered to your mailbox; certain and known spam is automatically deleted.

The following chart illustrates the differences in the policies:

	Personal Spam Policies
	Cautious	Cautious Plus	Aggressive	No Quarantine	Cautious Plus, No Quarantine
Not Spam (spamscore=0-49)	delivered	delivered	delivered	delivered	delivered
Possible Spam (spamscore=50-70)	quarantined	quarantined	quarantined	delivered	delivered
Likely Spam (spamscore=80-98)	quarantined	quarantined	deleted	deleted	delivered
Certain Spam (spamscore=99-100)	quarantined	deleted	deleted	deleted	deleted
Known Virus	deleted	deleted	deleted	deleted	deleted

How to Adjust your Personal Spam Policy

1. Login to the UIS Proofpoint Portal
2. Click on Profile in the lower left corner of the window
3. Choose the policy that works best for you
4. Click Save

Safeguarding your email

Over the past several years, Spam Control has proven to be very reliable at correctly distinguishing spam from real email. However, an occasional mistake might occur--spam might slip through the filters or, conversely, an email from your friend could get caught. Spam Control has additional safeguards if you are concerned that your legitimate email messages might be mistaken for spam.

The Quarantine and Daily Digests

Some policies use a separate storage space called the Quarantine to hold email marked as spam so that they do not take up space in your email account. If you choose a policy that quarantines spam, please be aware that emails in the Quarantine for more than 10 days will be automatically deleted.

You can view the contents of your Quarantine through daily email digests, which will list all emails added in the past 24 hours. You can choose to release an email if you want to make sure it is not legitimate email. It is recommended that you review the list every day to make sure there are not any legitimate emails in your Quarantine.

How to view your Quarantine

1. Login to the UIS Proofpoint Portal
2. Review the messages that you do not believe should be quarantined
3. Choose to either Release the message, Allow Sender, mark it as Not Spam or leave it in quarantine to be deleted after 10 days.
4. When you are done reviewing your Quarantine be sure to Logout of your UIS Proofpoint Portal

Safe and Blocked Senders Lists

You can add your correspondents' email addresses to your Safe Senders list, which will prevent them from being marked as spam. Similarly, you can add unwanted email addresses to your Blocked Senders list.

Information Technology Services also maintains a Global Safe List. This allows official University communication to go through Spam Control to users' mailboxes.

Managing Safe and Blocked Senders Lists

1. Login to the UIS Proofpoint Portal
2. Click on Lists in the lower left corner of the window
3. Choose the list you want to view under My Lists on the left side of the screen
4. You can either add senders, edit senders, or delete senders from this location

Adapting to emerging spam threats

Information Technology Services receives constant updates from Spam Control's software vendor on global emerging spam threats, allowing us to quickly and accurately identify the worst spam servers. Using a practice known as connection blocking, ITS restricts these servers' communication with our campus mail server, making it less likely that spam can end up in your mailbox.

---

Information Technology Services Spam Control uses a statistical model based on thousands of attributes such as language in the subject and body, the origination of the message, and information in the message's headers to evaluate each message sent to netID@uis.edu. Depending on its attributes, each message is "tagged" with a score from 0 to 100. The higher the number, the more likely the message is spam. You can see the tagged score by viewing the full headers of your email message.

Spammers constantly change how they send spam in order to deceive anti-spam programs. Spam Control updates its scoring attributes continually to keep pace with emerging spam threats.

Note: Information Technology Services receives constant updates from Spam Control's software vendor on global emerging spam threats, allowing us to quickly and accurately identify the worst spam servers. Using a practice known as connection blocking, we restrict these servers' communication with our campus mail server, making it less likely that spam can end up in your mailbox. Because these spam messages are blocked before they are even sent, they are not scored and processed by Spam Control.

Your Personal Spam Policy is comprised of your chosen spam management options. You can choose a Personal Spam Policy that will automatically set the threshold for a message to be regarded as spam. The Cautious, Cautious Plus, Aggressive, and No Quarantine policies use the following thresholds:

Score	Regarded as	Definition
0 to 49	Not Spam	The email is legitimate correspondence
50 to 79	Possible Spam	The email has questionable characteristics but could be legitimate.
80 to 98	Likely Spam	The email is probably spam.
99 and 100	Certain Spam	The email is definitely spam.

So what does this mean?

The spam policy you choose determines how you what suspicious spam messages you see.

• Email with a score >98 will certainly get discarded...unless you safelist the sender
• Email with a score >80 will be 'likely spam'.. and discarded by aggressive policies, or quarantined by others

The Cautious, Cautious Plus, Aggressive, and No Quarantine polices will either quarantine or delete spam automatically for you.  See these KB articles for more information about the available policies and how you customize Spam Control to meet your spam tolerance.

---

URL Defense [URL Re-Writing]

In an effort to reduce the occurrence of malicious URLs for our Campus email customers, Technical Services has implemented Proofpoint's Targeted Attack Protection (TAP) service. This service verifies the URLs in email are not malicious and then it rewrites the URL to reflect it has been verified by our Spam Control service.