Filtering Spam with Barracuda
Contents |
Page Navigation
- Spam Quarantine Summary Email
- Logging In to the Barracuda Spam Firewall
- Qarantine Inbox and Quarantine Settings
- Manage Spam Scoring
- Manage Your Allowed/Blocked List
- Mailman Mailing Lists
- View Message Header/Source
- Spam FAQ and Clarifications
The CS department uses Barracuda Spam Firewalls for spam filtering.
By default, users will have a quarantine inbox that resides on the Barracuda firewall. Messages in the quarantine will be held for 30 days, after which the message will be removed and discarded. You will receive a message at 3:35 PM ET alerting you of messages in your Quarantine Inbox. (Figure 1.)
If your email client looks like the message in the example, you may interact with the Barracuda Spam Firewall directly through your email. If your email view is text only, you can click on the link provided in the email to view your quarantine inbox as shown in Figure 3. If you wish to log into the barracuda spam firewall directly, please follow the instructions below.
Spam Quarantine Summary Email
The Spam Quarantine Summary email displays the sender and subject of each email held in Quarantine. You may view the contents of the message by clicking the “View” link on the right under “Actions.”
If the message is a legitimate email, you may click on Deliver and the message will be sent to your Inbox.
If the quarantined message is from an individual from whom you frequently receive emails, you can click “Whitelist,” the message will be delivered to your Inbox and no further emails from this individual will be quarantined.
You can view “whitelisted” email addresses by visiting the web interface. See the section for Manage Your Allowed/Blocked List.
Logging In to the Barracuda Spam Firewall
Some of the links in the Spam Quarantine Summary email will automatically log you in to the spam firewall. You may also access the Spam Firewall from a web browser to authenticate.
In your web browser, enter https://barracuda00.cs.umd.edu
Provide your CS username and password to login.
Quarantine Inbox and Quarantine Settings
The web view of your Quarantine Inbox looks much like the view in the Spam Quarantine Summary email. The web interface provides some functionality for searching through the entire quarantine, which may grow quite large within 30 days.
The web view also allows you to “train” Barracuda to filter spam better for you. To “train” the spam firewall what is and is not spam in your quarantine, click on the box to the left of the message and then click on the Spam or Not Spam button that appears above the message list. A web view of the Quarantine Inbox is depicted in Figure 3.
To the right of the Quarantine Inbox tab is the Preferences tab. You may change the frequency of your quarantine summary email to “weekly” or “never” on this screen.
Enable Quarantine should remain set to “Yes.” If you do opt to disable the Barracuda quarantine, messages that would have been quarantined will be delivered to your Inbox and will have [QUAR] prepended to the subject line.
Viewing the header of a message in the quarantine box will indicate the scores that resulted in it being marked as spam. See the section of this document for View Message Header/Source.
Manage Spam Scoring
The web interface allows you to change various personal settings for spam filtering. While it is possible for you to change Enable Spam Scoring to “No”, thus disabling all spam filtering, this is strongly discouraged.
To enable spam blocking or change the score at which messages are quarantined, you may wish to change Use Domain Defaults to “No.” The LOWER the value of the setting, the MORE message that will be quarantined. To change the settings that appear under Spam Scoring, change Use Domain Defaults to “No” and click the Save Changes button in the blue bar titled Spam Scoring.
The option, “Tag,” does not modify the subject line, contradicting the statement on the screen. Instead, “Tag” adds a designation to the message header which identifies the message as “Spam.” See the section on messages headers.
After changing Use Domain Default, as seen in Figure 5, to “No” and clicking Save Changes, the options available on the screen will change to those displayed in Figure 6. By default, message blocking is “disabled,” represented by the score of “10” on the defaults page. Blocked messages are different from quarantined messages. Blocked messages will not be accepted by the system and will be dropped.
Manage Your Allowed/Blocked List
To manage lists for allowed or blocked senders, click on Preferences, Whitelist/Blocklist. You may type an email address into the text box and click Add to insert a sender. You may click the trash can to remove the sender.
Managing the list of email addresses that will always be blocked from sending to you is managed under Blocked Email Addresses and Domains, as shown in Figure 7.
Mailman Mailing Lists
It is now policy for Barracuda firewalls to block all messages sent to “mailman” mailing lists with a spam score of 5 or greater.
If you recieve a message that has [QUAR] prepended to the subject line, this message was either sent to a mailing list of which you are a member, or you have disabled the quarantine inbox. There is no quarantine box enabled for inboxes of mailman mailing lists.
If you are the owner of a mailman mailing list and wish to have your spam filtering options changed, please contact staff[AT]cs.umd.edu
View Message Header/Source
To view header information for a message in your Quarantine Inbox, click on the message. Click View Source as shown in Figure 8.
The header information indicates that the QUARANTINE_LEVEL is set to 9.0. This message has a SCORE=13.65 so it resides in quarantine. Information on the total points accumulated for the various rules appear in the table.
If you receive a messsage that has [QUAR] prepended to the subject line, this message was either sent to a mailing list of which you are a member or you have disabled the quarantine inbox.
A message with a spam score between 3.5 - 8.9 will be delivered to you but will be tagged as spam in the header with the designation, X-Barracuda-Spam-Flag: YES.
A message with a spam score less than 3.5 will not have a X-Barracuda-Spam-Flag entry in the message header.
Spam FAQ and Clarifications
Q: What happens to messages in Quarantine? What should I do?
- A: Messages in Quarantine are messages Barracuda have flaged as “potentially” spam. Every single message that comes into your email is assigned a spam score. If that score is greater than or equal to the Quarantine score, than Barracuda will place it into your Quarantine Inbox , where you can choose to have the message delivered, mark it as Spam or Not Spam, and many other options. We advise against using Spam marking in the Quaratine Inbox because the message has already been caught by the filter, however, Not Spam and whitelist are helpful options.
Q: What happens if I don’t monitor my Quarantine? Should I worry about [QUAR] messsages?
- A: Messages in Quarantine will automaticaly be deleted 30 days after being placed in your Quarantine Inbox. It’s advised to check your Quarantine Inbox peroidically to see if any messages were wrongfully Quarantined. By default, Barracuda will not block messages, so all traffic can be seen either in your email inbox, or the Quarantine Inbox. If you recieve a message with the [QUAR] tag, it means that the email was delivered from your Quarantine Inbox (unless it came from a mailman list). If too many [QUAR] messages are coming through, you can set your local email’s spam filter to filter these messages or contact your mailman list administrator.
Q: I’m still getting too much Spam in my inbox. What can I do?
- A: If messages are not being Quarantined, it means that you need to adjust your spam score. Messages will be more likely to be Quarantined with this lower score. Because of this, its advised that if any changes are made to your spam score, you should closely monitor your Quarantine Inbox and report desired messages as either Not Spam or whitelist addresses.