about_content_scanning
ScanMail uses the Trend Micro Anti-spam Engine to implement heuristic-based policies when detecting unwanted content, or blocking, or automatically allowing a message. If you chose to install the End User Quarantine tool when installing ScanMail, ScanMail creates a spam folder on all of the mailboxes on the Exchange server where you installed ScanMail.
Content Scanning uses the following features to screen messages for spam:
Approved and Blocked sender lists
ScanMail does not classify addresses from the Approved senders list as spam (unless it detects a phishing incident), nor does it filter messages from this list as spam. ScanMail filters addresses from Blocked senders lists and always classifies them as spam with the action depending on the rule set by the administrator.
Note: The Exchange administrator maintains a separate Approved and Blocked Senders list for the Exchange server. If an end-user creates an approved sender, but that sender is on the administrator's Blocked Senders list, then ScanMail detects messages from that blocked sender as spam and takes action against those messages.
Spam filter
Administrators configure a spam detection rate to screen out spam. The higher the detection level, the more likely messages will be classified as spam.
The detection level determines how tolerant ScanMail is towards suspect email messages. A high detection level quarantines the most email as spam, but it might also falsely identify and quarantine legitimate email messages as spam, creating "false positive" spam mail. A low detection level does not rigorously screen email messages, but does not create many false positive spam messages.
Consider the following points after installing ScanMail:
Trend Micro Spam Folder
ScanMail creates a spam folder on all of the mailboxes on the Exchange server where you installed ScanMail. During the installation, the installation program prompted you to name this folder and it will have the name that you specified.
After installation, you can rename the spam folder using Microsoft Outlook. Trend Micro identifies the folder by ID, not by folder name.
Spam detection levels
ScanMail also configures the spam detection level defaults. The spam detection level filters out spam messages arriving at the Exchange server.
High: This is the most rigorous level of spam detection. ScanMail monitors all email messages for suspicious files or text, but there is greater chance of false positives. False positives are those email messages that ScanMail filters as spam when they are actually legitimate email messages.
Medium: ScanMail monitors at a high level of spam detection with a moderate chance of filtering false positives.
Low: This is the default setting. This is most lenient level of spam detection. ScanMail will only filter the most obvious and common spam messages, but there is a very low chance that it will filter false positives.
ScanMail takes one of the following actions depending on your configuration:
Quarantine message to user's spam folder
ScanMail moves the message to the Spam Mail folder located on the server-side of the Information Store.
Delete entire message
ScanMail deletes the entire message and Exchange does not deliver it.
Tag and deliver
ScanMail adds a tag to the header information of the email message that identifies it as spam and then delivers it to the intended recipient.
Note: This feature is not available on ScanMail Standard versions.
See also: