Categorizing Email Messages on the Overview Page

Stopped by IP Reputation Filtering

All connections blocked by HAT policies multiplied by a fixed multiplier (see the How Incoming Mail Messages are Counted) plus all recipients blocked by recipient throttling.

The value for Stopped by IP Reputation Filtering is calculated based on several factors:

• Number of “throttled” messages from this sender
• Number of rejected or TCP refused connections (may be a partial count)
• A conservative multiplier for the number of messages per connection

When the appliance is under heavy load, an exact count of rejected connections is not maintained on a per-sender basis. Instead, rejected connections counts are maintained only for the most significant senders in each time interval. In this situation, the value shown can be interpreted as a “floor”; that is, at least this many messages were stopped.

The Stopped by IP Reputation Filtering total on the Overview page is always based on a complete count of all rejected connections. Only the per-sender connection counts are limited due to load.

Invalid Recipients

All mail recipients rejected by conversational LDAP rejection plus all RAT rejections.

Stopped by Domain Reputation Filtering

The total count of messages blocked based on the reputation verdict of the sender domain.

Spam Messages Detected

The total count of messages detected by the anti-spam scanning engine as positive or suspect. Additionally, messages that are both spam and virus positive.

Virus Messages Detected

The total count and percentage of messages detected as virus positive and not also spam.

The following messages are counted in the “Virus Detected” category:

• Messages with a virus scan result of “Repaired” or “Infectious”
• Messages with a virus scan result of “Encrypted” when the option to count encrypted messages as containing viruses is selected
• Messages with a virus scan result of “Unscannable” when the action for unscannable messages is NOT “Deliver”
• Messages with a virus scan result of “Unscannable” or “Encrypted” when the option to deliver to an alternate mail host or an alternate recipient is selected
• Messages that are deleted from the Outbreak quarantine, either manually or by timing out.

Detected by Advanced Malware Protection

A message attachment was found to be malicious by file reputation filtering. This value does not include verdict updates or files found to be malicious by file analysis.

Messages with Malicious URLs

One or more URLs in the message were found to be malicious by URL filtering.

Stopped by Content Filter

The total count of messages that were stopped by a content filter.

If your access privileges allow you to view Message Tracking data: To view Message Tracking details for the Content Filter violations in this report, click a blue number link in the table.

Stopped by DMARC

The total count of messages that failed DMARC verification.

S/MIME Verification/Decryption Failed

The total count of messages that failed S/MIME verification, decryption, or both.

Marketing Messages

The total count of advertising messages sent by recognized professional marketing groups, for example Amazon.com.

This list item appears on the page only if marketing data are present in the system.

This number includes marketing messages identified both by Email Security appliances on which the graymail feature is enabled and by appliances on which Marketing Email Scanning under anti-spam settings is enabled.

Social Networking Messages

The total count of notification messages from social networks, dating websites, forums, and so on. Examples include LinkedIn and CNET forums. This information is determined by the graymail feature.

Bulk Messages

The total count of advertising messages sent by unrecognized marketing groups, for example, TechTarget, a technology media company.

This information is determined by the graymail feature.

Graymail Messages

This number includes marketing messages detected by the graymail feature, plus social networking messages and bulk mail. It does not include marketing messages identified on appliances on which the graymail feature is not enabled, even if those totals are included in the Marketing Messages value.

Click on the number corresponding to any of the graymail categories to view a list of messages belonging to that category using Message Tracking.

See also Reporting of Graymail.

S/MIME Verification/Decryption Successful

The total count of messages that were successfully verified, decrypted, or decrypted and verified using S/MIME.

Clean Messages Accepted

This category is mail that is accepted and deemed to be virus and spam free.

The most accurate representation of clean messages accepted when taking per-recipient scanning actions (such as splintered messages being processed by separate mail policies) into account.

However, because messages that are marked as spam or virus positive and still delivered are not counted, the actual number of messages delivered may differ from the clean message count.

If messages match a message filter and are not dropped or bounced by the filter, they are treated as clean. Messages dropped or bounced by a message filter are not counted in the totals.

Messages processed on appliances on which the graymail feature is not enabled are counted as clean.

Total Attempted Messages

This number includes spam, marketing messages (whether found by the graymail feature or by Marketing Email Scanning functionality in the anti-spam feature), social networking messages, bulk mail, and clean messages.