Unified Score

Unified Score technology allows detection of unwanted mail messages by the unified score assigned to each message. Message score is a signed integer. The greater it is, the higher is the probability that the message is unwanted, and vise versa - the smaller the number, the lower the probability that the message is unwanted. By default, a message is not considered spam if its score is less than the SpamThreshold parameter value (that is, 99 and less).  If a message score is greater than the SpamThreshold value, but less than UnconditionalSpamThreshold (that is, from 100 to 999 by default), this message is considered spam. If a message score is greater than the UnconditionalSpamThreshold value (1000 by default), this message is considered to be an unconditional spam.

Message score can be modified in the following ways:

•in the parameters of the Action type you can use an optional action - score (SCORE), where SCORE is an integer, which can be added to the current message score (or subtracted from the score if this value is negative).

•Vaderetro anti-spam plug-in assigns a score to the message, and this score is added to the total message score which is compared to spam threshold values).

•you can also modify a message score using Rules of some plug-ins, as well as by changing some parameter restrictions in the [Receiver] section.

•using Reputation IP Filter that allows modification of all message scores in the current session.

Message score is used in:

•Vaderetro plug-in that compares the score to the spam thresholds;

•conditions of message processing rules (with the score prefix);

•conditions of Dr.Web Modifier plug-in (using add_score и set_score commands);

•if a message score becomes greater than the MaxScore parameter value from the [MailD] section of the Dr.Web MailD configuration file, the message check is aborted and action specified in the MaxScoreAction parameter is applied;

•some restrictions that allow to apply different actions to the message depending on its current score;

•drweb-receiver to block whole sessions if total message score exceeds the MaxSessionScore parameter value from the[Receiver] section.

•score_filter from Reputation IP Filter that allows filtration of IP addresses which have too large total score.