- Status: approved 14 March 2008
- Background:
Before moving to UF, all outside messages arriving at the IFAS e-mail servers were delivered--either to the recipient's Inbox or to their Junk E-mail folder. This was done intentionally to allow recovery of messages marked falsely as spam; mistakes which occurred could be resolved by the user. With the move to UF Exchange, this is no longer the case--at least under the default settings.
- Currently:
UF Exchange has implemented an appliance from Barracuda Networks to save both time and money. This reduces load on our new servers by intercepting spam before it can reach those systems. The Barracuda examines and scores messages as they arrive from outside; a higher numeric score indicates a higher likelihood that a message is spam. These numeric scores are then compared against control settings to determine how particular messages get handled.
Depending on control settings a message will either be delivered or retained by the Barracuda. The current default control settings are:
| Setting | Spam Score | Result |
| Allow: | 0.0 - 2.0 | Delivered to Inbox |
| Tag: | 2.1 - 2.4 | Delivered to Inbox with subject line tagged |
| Quarantine: | 2.5 - 3.4 | Retained in quarantine |
| Block: | 3.5 - Up | Blocked (retained w/o notice) |
- The problem:
The above settings have been proven effective for very high volume users who are willing to accept the tradeoff of losing some messages (those which are blocked) against the convenience of having things managed for them. The great majority of users, however, do not receive high volumes of messages from outside our organization. Under the current defaults, examples have been documented of messages being blocked which should have been delivered.
- Recommendation:
If the majority of blocked messages were instead sent to the quarantine the effect on quarantine sizes would be minor overall (increasing the daily average quarantine per user from 0.46 to 0.53) while providing assurances similar to those previously in place for IFAS--that is, users could view their quarantine and locate messages which had been scored inappropriately.
The ICC recommends that UF Exchange modify the default Barracuda spam scoring levels as follows:
| Setting | Spam Score | Result |
| Allow: | 0.0 - 2.0 | Delivered to Inbox |
| Quarantine: | 2.1 - 8.9 | Retained in quarantine |
| Block: | 9.0 - Up | Block with only the highest confidence |
| Tag: | 10 (indicates disable) | No tagging for simplification |
- Remediation:
No default setting will be appropriate for everyone. Consequently, support must be readily available to identify and assist high volume users whose quarantined e-mail grows inordinately due to changes in the default. Additionally, on-line documentation should provide details on how to adjust score levels appropriately for various common situations.
- Action on recommendation:
Forwarded to the IFAS UF Exchange Advisory committee representative, Dr. Mark Rieger, for consideration by the committee
