GroupWise Junk Mail Tutorial:
Bulk Tag Explanation

By Jason Gutierrez, Network Computing Services, GroupWise Messaging Specialist

Question: Why is mail tagged BULK: at the beginning of the subject line?

Answer: Keywords and phrases within the mail message triggered the spam gateway to mark it as potential junk mail.

Explanation:

When a piece of mail comes into the UNT mail system, it is evaluated for viruses and for content. The content of a message is read by a server process that evaluates the text for characteristics which include keywords and phrases.

A dictionary or index tells the spam gateway which words and phrases are indicative of spam. If a characteristic of the email message triggers a response a score will be added to that message's overall score. If the overall score exceeds 6.0, then the message is tagged with "Bulk:" prepended to the subject line. This gives the GroupWise user a hook by which to catch unsolicited email and move it to either another directory or the trash.

In addition to a message's characteristics, email are also compared to lists of know spammers. These lists are called RBL's or real time blacklists. These lists are managed by spam tracking agencies to which we subscribe for the purpose of evaluating message content.

You will notice in the above example that this message was tagged as spam. If you would like to find out what the score of the spam message is, or why this message was marked as spam, you may follow these directions.

1) Open the bulk tagged message.

2) Click the "View" button in the toolbar represented by an icon of a pair of glasses.

3) Click the file marked "Mime.822" in the window that appears.

The mime.822 document contains specific delivery information pertaining to this message. What you are looking for are the lines that begin X-Spam.

The line X-Spam-Flag: will read either yes or no indicating whether or not this message is spam.
The line X-Spam-Status: records the overall spam score as hits and the threshold score as required.
The X-Spam-Report: reports the characteristics of the message that triggered a response the corresponding score.

X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express V6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Spam-Flag: YES
X-Spam-Level: ******
X-Spam-Status: Yes, hits=6.1 required=6.0 tests=BIZ_TLD,HTML_10_20,
HTML_MESSAGE,HTML_TAG_EXISTS_TBODY,RCVD_IN_DSBL,RCVD_IN_SORBS
autolearn=no version=2.63
X-Spam-Report:
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.1 HTML_TAG_EXISTS_TBODY BODY: HTML has "tbody" tag
* 2.0 HTML_10_20 BODY: Message is 10% to 20% HTML
* 1.8 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
* 1.1 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
* [<http://dsbl.org/listing?81.218.123.240>]
* 1.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
* [81.218.123.240 listed in dnsbl.sorbs.net]

Learn to create a BULK: mail rule.

If you would like to learn how to create a GroupWise rule which will automatically move mail tagged as BULK into a folder, you will find this tutorial online at: http://ncs.unt.edu/gw/howto/junkmail/BULKmail/index.htm.

More GroupWise 6.5 Tutorials

A list of more GroupWise 6.5 "Tutorial Topics" can be found here: http://ncs.unt.edu/gw/howto/index.htm

Return to top