What does score and threshold mean? How are they calculated?

The score of a message is the result of a combined classification. Based on the collected data and using a complex algorithm, we try to classify the message as well as possible. The filter determines how likely a message is to be spam. The higher the score, the more likely it is to be spam. The lower the score, the less likely the message is to be spam.

In the web interface, you have the option of setting an individual threshold value for the quarantine and thus defining when the filter should treat a message as spam. This means that if a message is given a score by the filter that is higher than the set threshold value for the quarantine, then this message is treated as spam and stored in the quarantine.

Here are some of the factors that we use when classifying a sender and which can lead to a combined score:

• A HELO/EHLO that differs by 4 or more levels from the real reverse hostname of the server.
• A sender with a low confidence level.
• The sender does not use MX entries.
• Reverse DNS lookup failed.
• Invalid sender
• No verifiable sender address in the message header.

By default, a threshold value of 0.90 / 0.89 should be used for the quarantine. The higher the value, the more spam you will probably receive. The lower the value, the stronger the classification.