Smarsh Hosted Services mail filters inspects each email message and determines the probability of that message being spam. Advanced Email Security puts a special identifier X-Spam-Status in the header area of the message, which is then used as a filtering mechanism in our email system. Read the Knowledge Base article on What are complete headers? How do I get them? for more information on headers.

Using a rule base and scoring system, a wide range of heuristic tests are performed on the mail headers and body text by Advanced Email Security

Each test has a specified score associated with it. If the total score of the message exceeds the Advanced Email Security sensitivity level, the email message is then considered spam and tagged with the spam identifiers.

The "X-Spam-Status:" identifier includes:

  • The successful spam tests identified
  • The email message total score or hits
  • Advanced Email Security sensitivity level value 

Header example #1, where the message is not spam:

To: <user@msoutlookonline.net>
Subject: Regular Email
Date: Wed, 26 Feb 2009 14:05:47 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0040_01C2DDA0.292F5970"
X-Priority: 3
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Spam-Status: No, hits=1.3 tagged_above=-999.0 required=3, tests=BAYES_20, HTML_70_80, HTML_MESSAGE

Header example #2, where the message is spam:

To: <user@msoutlookonline.net>
Subject: Spam Email
Date: Wed, 26 Feb 2009 14:01:16 -0800
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_002D_01C2DD9F.876C8590"
X-Priority: 3
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Spam-Status: Yes, hits=10.6 tagged_above=-999.0 required=7.0 tests=BAYES_56,
CLICK_BELOW, EXCUSE_10, EXCUSE_14, EXCUSE_22, EXCUSE_23, EXCUSE_24,
EXTRA_MPART_TYPE, HTML_60_70, HTML_COMMENT_SAVED_URL, HTML_FONT_COLOR_BLUE,
HTML_LINK_CLICK_HERE, HTML_MESSAGE, HTML_TAG_EXISTS_TBODY, MAILTO_LINK,
OFFER, OFFERS_ETC, OPT_OUT, ORIGINAL_MESSAGE, RECEIVE_EMAIL, SMTPD_IN_RCVD