What does score and threshold mean? How are they calculated?

The score of a message is the result of a combined classification. Based on the total data and using a complex algorithm we try to classify the message as best we can. The filter determines how likely a message is to be spam. The higher the score, the more likely it is spam.

In the web interface you have the option to configure an individual threshold value for the quarantine and thus determine from when it is spam. This means if a message is scored by the filter with a score higher than the quarantine threshold, then this message is treated as spam and placed in quarantine.

Here are some of the factors that we use when classifying a sender and which can lead to a combined score:

• A HELO/EHLO that differs by 4 or more levels from the real reverse hostname of the server.
• A sender with a low confidence level.
• The sender does not use MX entries.
• Reverse DNS lookup failed.
• Invalid sender
• No verifiable sender address in the message header.

By default, a threshold value of 0.90 / 0.89 should be used for the quarantine. The higher the value, the more spam you will probably receive. The lower the value, the stronger the classification.