Understanding Mail Filtering

This section describes mail filtering technologies.

Mail filtering technologies fall into the following types:

IP address-based filtering: Anti-spam filters out junk email by checking the legitimacy of the sender's IP address.
Mail content filtering: Mail content filtering is used in an anonymous mail check, mail address check, and attachment control. These functions filter out email based on the senders' or receivers' IP addresses, attachment size, and the number of attachments.

If the anti-spam, anonymous mail check, mail address check, and email attachment control functions are all configured on the FW, the functions takes effect in the following order:

Anti-spam
- Legitimate email goes through follow-up inspections.
- For junk email, if the filtering action is block, the email is discarded; if the filtering action is alert, it must go through the follow-up inspections.
Anonymous mail check
- Legitimate email goes through follow-up inspections.
- For anonymous email, if the filtering action is block, it is discarded; if the filtering action is alert, it must go through the follow-up inspections.
Email address check
- Email that meets all specified conditions needs to go through follow-up inspections.
- Email that does not meet the specified conditions is discarded.
Email attachment control
- Email that meets all conditions is permitted.
- Email that does not meet the specified conditions is discarded.

Mechanism for Sending and Receiving Email: This section describes the mechanism for sending and receiving email.

Anti-Spam: Anti-spam can be implemented by checking the source IP address of the sender's SMTP server or by filtering fields in the MIME header.

Mail Content Filtering: Anonymous mail checks, mail address checks, and email attachment control filter out illegitimate email based on email content. They check the mail addresses of the sender and receiver, the attachment size, and the number of attachments.