Department of Engineering

Automated filters on incoming email

Introduction

Electronic mail increasingly presents two problems for users: unsolicited bulk email ('spam'); and computer viruses carried as attachments to email messages. To minimise both of these problems, email to which is delivered via the Engineering Department servers is subject to automated filters intended to reject suspect messages. This page describes the current filters and the planned developments. It also advises on what you can do if you believe that legitimate email intended for you is being rejected.

All personal email is now delivered to Hermes, but if it is sent via and @eng.cam.ac.uk address it will still be subject to the Spam filters below, although we do not do any virus scanning of this mail. Such email will also be subject to the restrictions and filters on Hermes. See the Computing Service documentation on Spam and other unwanted mail and Mail viruses. There are also still exist a very small number of mail accounts on the engineering mail server. These are usually role accounts for a specific purpose, or shared email accounts. These are subject both spam and virus filtering.

'Spam' filters

These filters are intended to block unsolicited bulk email, usually unwanted advertising material. Since November 2001, the Department has used RBL+ to reject email coming from suspect sources. This uses a database of addresses that have been identified as generating, or allowing the transmission of, unwanted email. RBL+ also rejects mail identified as arriving via routes other than official mail servers (a common characteristic of 'spam'). More recently it has also started to use the SBL and the XBL.

In addition, the Department's system also blocks mail coming from sources which have previously tried to send junk or abusive email to the Department.

Despite these blocks, some unwanted mail may still get through. Our page on junk email advises on what you can do if you receive such mail, and how to report it.

What to do if the filters are blocking genuine email or attachments

If you find that legitimate attachments intended for you are being blocked by the filters, it should be possible to find a way round the block. The best method is to ask the sender to enclose the attachment in a zip file (the standard PC means of archiving and compressing files). If this is not possible, ask them to rename the attachment with a non-standard filename extension (e.g. remove the '.exe'). When you receive it, rename it back to the original name before opening it. If you require further help, please contact postmaster-mua@eng.cam.ac.uk for advice.

If the blocked message did not contain an attachment, or was returned to the sender with an error message starting "Access denied", the message has probably been blocked by one of the 'spam' filters. In this case there are four possibilities:

• If the sender uses a dial-up Internet service or a dynamically allocated port, it is possible that they are not submitting mail via their ISP's official outbound mail server. (See http://mail-abuse.org/dul/enduser.htm for why this is blocked.) They can easily solve the problem by setting their mail program to use their ISP's official mail server.
• The mail has been blocked because the source is in the RBL+ list of suspect addresses. In this case the error message should contain a URL which gives more details as to why the source is blocked. In general sites in RBL+ which are no longer sources of junk email should follow the information found at http://mail-abuse.org to get themselves removed from RBL+.
• The mail has been blocked because the source is in the SBL list of suspect addresses. In this case the error message should contain a URL which gives more details as to why the source is blocked. In general sites in SBL which are no longer sources of junk email should follow the information found at http://www.spamhaus.org/ to get themselves removed from SBL.
• Otherwise, the message is probably coming from a site or address range that we have identified as a source of junk or abusive mail in the past. In this case, the best course of action is to ask the sender to forward a copy of the complete rejection message to postmaster@eng.cam.ac.uk (mail to postmaster will not be rejected). Postmaster can then investigate and try to find a solution.

If all else fails email postmaster@eng.cam.ac.uk with as many details as possible about the sender of the mail (e.g. email address, site sending the mail, and when it was failing).

Role accounts on the Engineering mail servers

If you have a role account on our servers then as well as being subject to the spam filters outlined above it is also checked for viruses.

Email has become one of the most common ways in which computer viruses are spread: a virus is sent as an email attachment, disguised as something harmless and often appearing to come from an acquaintance. When the attachment is opened, the virus infects the computer and spreads itself further.

Viruses are all programs of one kind or another, and, on Windows PCs, programs can generally be identified by the 'filename extension', for example ".exe". As an initial step to address this problem, the first set of mail system filters being used in the Department will generally block any messages which appear to have Windows programs attached to them. This approach may occasionally mean that some genuine attachments are also blocked; see above for ways in which you can work round this.

Any message which has a zip file attached to it is quarantined on our server, and will only be delivered if our virus scanning software determines that the zip file does not contain a virus and after checking by one of the postmaster team. Other messages which look suspicious are also checked in this way. This may mean that there is sometimes a delay in legitimate emails with attachments, especially at weekends and bank holidays.

What the attachment filters do not do
The filters on email attachments do not mean that you can do without anti-virus software on your computer. They merely reduce the chances of a virus program getting through to you and fooling you into opening it. You must still take care when handling email attachments, and open them only if you know both who they are from and that they are safe. Make sure that you have up-to-date anti-virus software on your computer. Information on anti-virus software is available from the Computing Service.