Content Filtering

Problem reported by Rick Ryan - 4/6/2026 at 2:42 PM

Submitted

I'm on build 9560. I host multiple domains, primarily for family and family owned businesses. I do not have a staff to perform detailed analysis. I tend to try to use content filtering to get through whatever the latest SPAM/Virus/extortion fad is. It seems to me that the content filtering is not working.

I have multiple rules setup, some looking at headers, some at subjects, some at the message as a whole. Earlier today I added about two dozen new conditions to existing rules, none using wildcards. Throughout the afternoon I continue to receive messages that match the phrases I added to "delete message" rules.

What am I doing wrong, or are the content filtering rules not working right for others?

11 Replies

Reply to Thread

terry fairbrother Replied

4/7/2026 at 1:45 AM

Use Routing Rules rather than Content Filtering rules. I started out with CF rules and found them a little hit and miss but RR has been better. Personally I have around 20 rules, ranging from single words to language / IT / website / numbers etc and all set to quarantine the message. I have found that I need to quote everything - "targetword" as I was getting false positives as the targetword was in the middle of another word.

Where I get a false positive, I look at the routing rules log, look for the group then go through the email to determine the cause. I have requested a feature where the 'word' is also shown in the log to help pinpoint the cause.

I have also stopped using wildcards as I found them to cause more issues too

I also now use 'Subject or Body' as the main filtering. Header has to be exact and Raw seems to ignore everything

Douglas Foster Replied

4/7/2026 at 4:34 AM

I wish an employee would post on this topic. There is a lot of complexity to content filtering, since it is several different problems, depending whether you are searching text or html, and whether you are searching Ascii text or Unicode.

When searching for "bad stuff", which of these are matches:

Formatting tags in HTML: bad<strong>stuff</strong>
Paragraph break in HTML: bad<p>stuff
Line break in plain text: bad\r\nstuff
Paragraph break in plain text: bad\r\n\rn\stuff

And what if you want to search the HTML for a malicious tag, such as <script>

I have not seen a good description of how they deal with these issues, so it is hard to know how to explain unexpected results.

Brian Kropf Replied

4/8/2026 at 3:57 AM

I have noticed that if Bounce Message is included in the list of Actions, none of the other actions execute. I would like SmarterMail to change this behavior.

1) Offer a method of executing multiple actions in a specific order. The first action gets executed before the second one, etc.

2) Execute ALL actions in the filter. In my case, I wish to bounce the message back to the sender based on specific conditions. BUT I also want a copy of the message in a "for review" folder in the event that the Administrator determines the email is legit. They can then copy the email to the intended recipient's Inbox.

YS Tech Replied

4/17/2026 at 4:35 AM

@Rick Ryan

I've just been through a ticket with SM and have gained a bit more knowledge on the way the spam filters and content filters are working.

The reason the content filters aren't working (for me) is more than likley because the spam filters are working better and if they trigger first, it won't look to the content filters to do anything as it's already been filtered.

I think i've seen this because my spam filters are actually working better now and placing everything in the spam folder instead of it getting to my content filters that removed the emails or placed them in specific folders.

So, 2 options really.

1) Leave the filtering to do its work and if they are all spam going into the spam folder, choose what you do with them with the main spam filters, whether it be delete or just move to spam.

2) Change your weight ranges so certain probablility of spams don't get moved into spam, then these emails will then go onto the domain level spam filters and if not picked up by them, then onto the content filters.

I'm going to have a play around with the weight ranges and see what happens and when it starts triggering the content filters.

Spam/Content filter order:

1) System Spam checks

2) Domain level Spam checks (if different)

3) Domain level Content Filters

4) User level Spam checks (if different)

5) User level Content Filters

Rick Ryan Replied

5/4/2026 at 3:50 PM

So, I've created a number of Routing Rules. Most simply delete the message (L0wes, Marri0t, etc). For those requiring a bit of examination, I've set the action to "Quarantine". Where do those messages go? Not in the Spool pages. Log files for Routing Rules are worthlesss.

YS Tech Replied

5/5/2026 at 2:04 AM

@Rick Ryan, this will depend on whether anything else has been triggered before the rules you've setup.

So if the standard spam checks get triggered and the spam gets marked as spam or moved to a folder then it won't get to your rules to delete.

If they go into quarantine, I believe they go into the Spool > Spam Quarantine > area.

I've had to up my weights on my standard spam filter settings to allow my specific rules to work occasionally. But a lot of spam still gets caught by the standard spam fiilters and placed in the spam folder before the rules can do anything.

It would be nice to have an overriding spam rules that you could setup that would just enable you to delete specific emails before you start to process them. So instead of this:

Spam/Content filter order:

1) System Spam checks

2) Domain level Spam checks (if different)

3) Domain level Content Filters

4) User level Spam checks (if different)

5) User level Content Filters

You'd have something like:

Spam/Content filter order:

0) Priority Custom Filters

1) System Spam checks

2) Domain level Spam checks (if different)

3) Domain level Content Filters

4) User level Spam checks (if different)

5) User level Content Filters

terry fairbrother Replied

5/6/2026 at 5:50 AM

"Log files for Routing Rules are worthlesss"

I requested a feature upgrade so that the routing rules logs also contained the keyword(s) that triggered the rule. In my mind it's just a string added the the line so should be easy enough to add, but the feeling was that it makes the logs bloaty. I disagree, it makes the logs better and I don't spend a long time wading through hundreds of keywords to work out which one made the rule activate.

J. LaDow Replied

5/6/2026 at 6:13 AM

A detailed IMAP log from our little server can hit 200mb a day. That said, I don't see valid reason to block enhancement of ANY log files when necessary, let alone "for size or bloat". Especially when the IMAP "normal" or "exceptions only" logs are basically identical and useless (as an example)...

MailEnable survivor / convert --

Douglas Foster Replied

5/6/2026 at 6:58 AM

Logs over 2GB are a problem on Windows. so rollover based on size should be considered.

MAPI detailed log is so verbose that it might hit that limit. I don't know what a useful MAPI log would contain, but I have not found a good way to use either normal or detailed data from it.

J. LaDow Replied

5/6/2026 at 7:19 AM

-> Douglas Foster

I agree that there should be a considered rollover size, and it should be somewhere in the hundreds of MB, not GB -- as many utilities cannot reasonably deal with files that size to begin with.

MailEnable survivor / convert --

John Quest Replied

5/8/2026 at 3:44 PM

Instead of rollover based upon size, what about rollover available per hour?

Back to Community Threads

Please leave this box unchecked

Reply to Thread

Enter the verification text