The application processes email messages in accordance with the following algorithm:
The Scan Logic message scanning control module determines which message processing rules apply to a message based on the combination of the sender and recipient addresses, and chooses the rule with the highest priority. If no rules are found for the address pair, the application processes the message in accordance with the settings of the Default preset rule.
If the message is addressed to multiple recipients whose addresses belong to different rules, the application creates several virtual copies of the message in accordance with the number of rules. The message processing rule to which the recipient address belongs is applied to each copy of the message.
Further actions taken by the application depend on the settings of the selected message processing rule.
If the rule specifies that messages are to be scanned for spam, the Scan Logic module forwards the email message to Anti-Spam engine for scanning.
The Anti-Spam engine scans the message and assigns one of the spam scan status labels to it. Information about the status assigned is contained in the special information X-header X-KLMS-AntiSpam-Status, which Scan Logic adds to the message after it is processed. Based on the results of message scanning, the Scan Logic module also adds a status tag at the beginning of the message subject.
If the rule specifies that messages are to be scanned for phishing threats, the Scan Logic module forwards the email message to the Anti-Phishing engine for scanning.
The Anti-Phishing engine scans the message and assigns one of the phishing scan status labels to it. Information about the status assigned is contained in the special information X-header X-KLMS-AntiPhishing, which Scan Logic adds to the message after it is processed. Based on the results of message scanning, the Scan Logic module also adds a status tag at the beginning of the message subject.
If the rule specifies that messages are to be filtered for content, the Scan Logic module performs content filtering of the message by size, name, and format of attachments.
As a result of content filtering, Scan Logic assigns one of the following content filtering status labels to messages:
If the rule settings define a virus scan of messages, the Scan Logic module forwards the email message to the Anti-Virus engine for scanning.
The email format analyzer (MIME, RFC2822, UUE) built into the Anti-Virus engine parses the individual objects of the message: body, attachments, and others. Every object received is sent to Anti-Virus engine for scanning.
Anti-Virus first scans messages as one object and then one message part at a time and assigns one of the anti-virus scan status labels to the message. Based on the results of message scanning, the Scan Logic module adds a status tag at the beginning of the message subject.
Depending on the resulting status, the application carries out actions configured in the settings of the rule that is applied to the message.