User guide

Using VStream Antispam
526 Check Point Safe@Office User Guide
attacks on your gateway or mail server.
If you do not have a mail server in your network, there is no need to enable the IP
Reputation engine. (If you do enable this engine anyway, it will have no negative
effects.)
• Block List
VStream Antispam allows configuring a list of senders whose emails should be
blocked. When an email reaches your mail server, the Block List engine determines
whether the sender's email address appears on the list. If so, then VStream Antispam
blocks the emails.
• Content Based Antispam
The Content Based Antispam engine calculates a “spam fingerprint” for each
incoming email message. The fingerprint is then sent to a VStream Antispam data
center and compared to a constantly updated database of spam messages. The data
center returns a "spam score", which is a value in percentages indicating the likelihood
that the message is spam. If the spam score exceeds a user-configurable threshold
called the “confidence level”, the message can be flagged as spam, or the message can
be deleted altogether.
In addition, VStream Antispam allows you to define a Safe Sender List, which consists of
senders who are exempt from the Block List and Content Based Antispam engines.
The following table provides a comparison of the VStream Antispam engines.
Table 118: Comparison of VStream Antispam Engines
IP Reputation
Content Based Antispam and
Block List
Supported Protocols Protects mail servers only, and
applies to the SMTP protocol only
Protects both mail servers and mail
clients, and applies to both POP3 and
SMTP protocols
Email Scanning Time Scans the email before accepting
the connection
Scans the email after accepting the
connection