hmLoadTopic({
hmKeywords:"AntiSpam,AntiVirus,MDaemon AntiVirus,Outbreak Protection,Viruses",
hmTitle:"Outbreak Protection",
hmDescription:"Outbreak Protection is part of the optional MDaemon AntiVirus feature. Enabling MDaemon AntiVirus for the first time will start a 30-day trial. If you wish to purchase this fea",
hmPrevLink:"mdpgp.html",
hmNextLink:"cf_and_av.html",
hmParentLink:"security_menu.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a>",
hmTitlePath:"Security Menu > Outbreak Protection",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">Outbreak Protection<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText\"><span class=\"f_BodyText\">&nbsp;<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0.6250rem 0.7500rem 0.6250rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Outbreak Protection is part of the optional <a href=\"antivirus.html\" class=\"topiclink\">MDaemon AntiVirus<\/a> feature. Enabling MDaemon AntiVirus for the first time will start a 30-day trial. If you wish to purchase this feature, contact your authorized MDaemon reseller or visit:<\/span><span class=\"f_Notes\"> <a href=\"https:\/\/mdaemon.com\/pages\/mdaemon-email-antivirus-antispam\" target=\"_blank\" class=\"weblink\">mdaemon.com<\/a>.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Outbreak Protection (OP) is accessible from MDaemon<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s <\/span><span class=\"f_MenuPath\">Security<\/span><span class=\"f_BodyText\"> menu (<\/span><span class=\"f_MenuPath\">Security <\/span><span class=\"f_MenuPath\" style=\"font-family: Verdana,Geneva,Arial,sans-serif;\">»<\/span><span class=\"f_MenuPath\"> Outbreak protection...<\/span><span class=\"f_BodyText\">, or <\/span><span class=\"f_MenuPath\">Ctrl+Shift+1<\/span><span class=\"f_BodyText\">). It is a revolutionary real time anti-spam, anti-virus, and anti-phishing technology capable of proactively protecting an MDaemon email infrastructure automatically and within minutes of an outbreak.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Outbreak Protection is completely content agnostic, meaning that it doesn\'t rely on strict lexical analysis of message content. Thus, it doesn\'t require heuristic rules, content filtering, or signature updates. Further, that means it is not fooled by the addition of seed text, clever spelling changes, social engineering tactics, language barriers, or differences in encoding techniques. Instead, OP is based on<\/span><span class=\"f_BodyText\"> Recurrent Pattern Detection and Zero-hour technologies. It relies on the mathematical analysis of message structure and message distribution characteristics over SMTP—it analyzes &quot;patterns&quot; associated with an email transmission and compares them to similar patterns collected from millions of email messages worldwide, which are sampled and compared in real time. <\/span><span class=\"f_BodyText\" style=\"font-weight: bold;\">Note:<\/span><span class=\"f_BodyText\"> OP never transmits the actual content of messages, nor can message content be derived from the extracted patterns.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Because messages are being analyzed worldwide in real time, protection is provided within minutes—often seconds—of a new outbreak. For viruses, this level of protection is critical since it is often hours after an outbreak before a traditional antivirus vendor can verify and submit a virus signature update, and it can then be even longer before that update is put into production use. During that interval, servers without Outbreak Protection are vulnerable to that particular outbreak. Similarly, for spam messages it will often take time and effort to analyze the spam and create a safe filtering rule before it will be recognized by traditional heuristic and content based systems.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">It is important to note, however, that the Outbreak Protection feature is not a replacement for traditional anti-virus, anti-spam, and anti-phishing techniques. In fact, OP provides another specialized layer of protection on top of the existing heuristics, signature, and content based tools found within MDaemon. Specifically, OP is designed to deal with large-scale outbreaks rather than old, unique, or specifically targeted messages that can be more readily caught by the traditional tools.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">&nbsp;<\/span><\/p>\n\r<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:28.5000rem;height:32.8750rem;border:none\" src=\".\/images\/outbreak-protection.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Outbreak Protection<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable Outbreak Protection<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this checkbox to enable Outbreak Protection for your server. Incoming messages will be analyzed to see if they are part of an ongoing virus, spam, or phishing outbreak. The remaining options on this dialog are used to determine what will be done with messages found to be part of an outbreak, and to designate the senders that will be exempt from OP processing.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Viruses should be...<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid; margin: 0.3125rem 0.3125rem 0 3.0000rem;\"><span class=\"f_ControlHeading\">blocked in real time<\/span><\/p>\n\r<p class=\"p_ControlIndent\" style=\"margin: 0 0.3125rem 0.8750rem 3.0000rem;\"><span class=\"f_ControlIndent\">Select this option if you wish to block messages during the SMTP process when they are determined to be part of a virus outbreak. These messages will not be quarantined or delivered to their intended recipients—they will be rejected by the server.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid; margin: 0.3125rem 0.3125rem 0 3.0000rem;\"><span class=\"f_ControlHeading\">quarantined<\/span><\/p>\n\r<p class=\"p_ControlIndent\" style=\"margin: 0 0.3125rem 0.8750rem 3.0000rem;\"><span class=\"f_ControlIndent\">Select this option if you wish to accept messages that OP determines are part of a virus outbreak. Although these messages will not be rejected by the server, they will be quarantined instead of delivered to their intended recipients. Quarantined messages are placed in the quarantine folder.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Spam should be...<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid; margin: 0.3125rem 0.3125rem 0 3.0000rem;\"><span class=\"f_ControlHeading\">blocked in real time<\/span><\/p>\n\r<p class=\"p_ControlIndent\" style=\"margin: 0 0.3125rem 0.8750rem 3.0000rem;\"><span class=\"f_ControlIndent\">Select this option if you wish to block messages during the SMTP process when OP confirms that they are part of a spam outbreak. These messages will not be flagged as spam and delivered to their intended recipients—they will be rejected by the server. Messages classified by OP as &quot;bulk&quot; mail will not be blocked by this option unless you activate the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">When blocking spam, block messages which classify as &quot;bulk&quot; spam also<\/span><span class=\"f_ControlIndent\"> option below. Messages classified as &quot;bulk&quot; by OP could simply be a part of certain very large mailing lists or other similar widely distributed content, so you may or may not consider those types of messages to be spam. For that reason, those types of messages generally shouldn\'t be scored negatively or blocked by OP.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid; margin: 0.3125rem 0.3125rem 0 3.0000rem;\"><span class=\"f_ControlHeading\">accepted for filtering<\/span><\/p>\n\r<p class=\"p_ControlIndent\" style=\"margin: 0 0.3125rem 0.8750rem 3.0000rem;\"><span class=\"f_ControlIndent\">Select this option if you wish to accept messages that OP confirms to be part of a spam outbreak, so that they can then be subjected to spam filtering and content filter processing. These messages will not be blocked by OP, but they will have their Spam Filter scores adjusted according to the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Score<\/span><span class=\"f_ControlIndent\"> option below.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">When using the <\/span><span class=\"f_Notes\" style=\"font-style: italic;\">accepted for filtering<\/span><span class=\"f_Notes\"> option, OP will not directly cause a confirmed spam message to be blocked, but a message may still be blocked by MDaemon during the SMTP process if you have configured the Spam Filter to use the <\/span><span class=\"f_Notes\" style=\"font-style: italic;\">SMTP rejects messages with scores greater than or equal to [xx]<\/span><span class=\"f_Notes\"> option, located on the <a href=\"sf_spam_filtering.html\" class=\"topiclink\">Spam Filter<\/a> screen.<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\">For example, if the scoring option below caused a message’s Spam Filter score to be 15.0, then the message would still be rejected as spam if you had also configured the Spam Filter’s “<\/span><span class=\"f_Notes\" style=\"font-style: italic;\">SMTP rejects...<\/span><span class=\"f_Notes\">” option to reject messages that have a score of 15.0 or greater.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid; margin: 0.3125rem 0.3125rem 0 3.0000rem;\"><span class=\"f_ControlHeading\">Score<\/span><\/p>\n\r<p class=\"p_ControlIndent\" style=\"margin: 0 0.3125rem 0.8750rem 3.0000rem;\"><span class=\"f_ControlIndent\">When using the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">accepted for filtering<\/span><span class=\"f_ControlIndent\"> option above, this amount will be added to a message’s Spam Filter score when OP confirms that the message is part of a spam outbreak.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">IWF Content<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">The following option applies to content identified by the Internet Watch Foundation (IWF) as referring to child abuse image sites (i.e. child pornography sites). It enables OP to use an integrated URL list provided by the IWF to detect and tag messages that refer to that content. The IWF operates an independent internet “hotline” for reporting potentially illegal online content, including child abuse content hosted anywhere in the world. They work in partnership with the police, governments, the wider online industry and the public to combat the availability of illegal online content. The Foundation’s URL list is updated daily with new sites hosting child abuse images.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Many organizations have internal compliance rules governing the content of email sent or received by its employees, especially with regard to obscene or illegal material. In addition, many countries have outlawed the sending or receipt of such content. This feature can assist in your efforts to ensure compliance.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">For more on the IWF, see:<\/span><\/p>\n\r<p style=\"margin: 0 0 0.8750rem 4.5000rem;\"><span style=\"font-family: \'Courier New\',Courier,monospace;\"><a href=\"http:\/\/www.iwf.org.uk\/\" target=\"_blank\" class=\"weblink\">http:\/\/www.iwf.org.uk\/<\/a><\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">IWF content should be...<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid; margin: 0.3125rem 0.3125rem 0 3.0000rem;\"><span class=\"f_ControlHeading\">blocked in real time<\/span><\/p>\n\r<p class=\"p_ControlIndent\" style=\"margin: 0 0.3125rem 0.8750rem 3.0000rem;\"><span class=\"f_ControlIndent\">Choose this option if you wish to reject incoming messages during the SMTP process when they have IWF restricted content.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid; margin: 0.3125rem 0.3125rem 0 3.0000rem;\"><span class=\"f_ControlHeading\">accepted for filtering<\/span><\/p>\n\r<p class=\"p_ControlIndent\" style=\"margin: 0 0.3125rem 0.8750rem 3.0000rem;\"><span class=\"f_ControlIndent\">Choose this option if you wish to increase a message’s Spam Filter score instead of rejecting it when it has IWF restricted content. The Spam Filter score will be increased by the amount specified in the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Score<\/span><span class=\"f_ControlIndent\"> option below.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid; margin: 0.3125rem 0.3125rem 0 3.0000rem;\"><span class=\"f_ControlHeading\">Score<\/span><\/p>\n\r<p class=\"p_ControlIndent\" style=\"margin: 0 0.3125rem 0.8750rem 3.0000rem;\"><span class=\"f_ControlIndent\">When the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">accepted for filtering<\/span><span class=\"f_ControlIndent\"> option above is selected, this is the amount that will be added to a message’s Spam Filter score when it contains IWF restricted content.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">When blocking spam, block messages which classify as “bulk” spam also<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Sometimes OP will identify certain messages that could be considered spam but aren\'t being sent from a known spammer or bot-net—as is sometimes the case with legitimate bulk mailings and newsletters. OP classifies these types of messages as &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Spam (bulk)<\/span><span class=\"f_ControlIndent\">&quot; rather than <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">&quot;Spam (confirmed)<\/span><span class=\"f_ControlIndent\">.&quot; Click this checkbox if you wish to apply OP’s spam blocking features to &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Spam (bulk)<\/span><span class=\"f_ControlIndent\">&quot; mail as well. If this option is disabled, only messages classified as &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Spam (confirmed)<\/span><span class=\"f_ControlIndent\">&quot; will be affected by OP’s spam blocking features above. &nbsp;Accepting this type of spam for later processing may be necessary for sites that want to receive bulk mailings but for some reason cannot exempt the source or recipient.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Log processing activity to MDaemon<\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading\">s plugin log file<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this checkbox if you wish to log all OP processing activity into MDaemon<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent\">s plugin log file.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Exceptions<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Authenticated SMTP sessions are exempt from OP processing<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When this option is enabled, authenticated SMTP sessions are exempt from OP processing. This means that messages sent during that session will not be subjected to Outbreak Protection checks.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">SMTP sessions from trusted IPs are exempt from OP processing<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you wish to exempt trusted IP addresses from Outbreak Protection—messages arriving from a server at a trusted IP address not be subjected to OP checks.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">SPF\/DKIM approved mail is exempt from OP processing<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this checkbox if you wish to exempt a message from OP processing when the sending domain appears on the <a href=\"security--approved_list.html\" class=\"topiclink\">Approved List<\/a> and it is validated by SPF or DKIM.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Spam Honeypots and Spam Filter allowed addresses are exempt from OP processing<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this option if you wish to exempt the <a href=\"spam_traps.html\" class=\"topiclink\">Spam Honeypots<\/a> and Spam Filter allow lists from Outbreak Protection. The allow list applies to the recipient, or RCPT value given during the SMTP session. The &quot;Allow List (from)&quot; applies to the sender, or MAIL value given during the SMTP session. These operations are not based on message header values.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">False Positives and False Negatives<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">False positives, or classifying a legitimate message improperly as part of an outbreak, should rarely if ever happen. Should a false positive occur, however, you can send that message to us at <\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-weight: bold; color: #010100;\">spamfp@mdaemon.com<\/span><span class=\"f_ControlIndent\"> for spam\/phishing false positives or <\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-weight: bold; color: #010100;\">virusfp@mdaemon.com<\/span><span class=\"f_ControlIndent\"> for virus false positives, so that we can use it to help refine and improve our detection and classification processes.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">False negatives, or classifying a message as not part of an outbreak even though it is still spam or an attack, will happen more often than false positives. However, it worth noting that OP is not designed to catch all spam, virus attacks, and the like—it is simply one layer of protection that specifically targets outbreaks. Old messages, specifically targeted messages and the like, which are not part of a currently ongoing outbreak, might pass the OP check. Those sorts of messages should then be caught by the other AntiVirus and MDaemon features further down the processing chain. Should a false negative occur, however, you can send that message to us at <\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-weight: bold; color: #010100;\">spamfn@mdaemon.com<\/span><span class=\"f_ControlIndent\"> for spam\/phishing false negatives or <\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-weight: bold; color: #010100;\">virusfn@mdaemon.com<\/span><span class=\"f_ControlIndent\"> for virus false negatives, so that we can use it to help refine and improve our detection and classification processes.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When sending improperly classified messages to us, the original email should be sent as a MIME &nbsp;email attachment rather than forwarded. Otherwise, headers and other information critical to the classification process will be lost.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">&nbsp;<\/span><\/p>\n\r"
})
