eXpurgate Support

Frequently asked questions

• eXpurgate Managed Service Notes   

  Please verify your technical data again and please check the stated primary MX host in particular. Please correct incorrect entries.

  Subsequently, please follow the instructions in the documentation of the name server configuration. Due to the high number of possible configurations we have limited the documentation to the general description of necessary modifications.

  Over the test period, emails identified as spam will be specially marked. This method enables you to define filters in your email client (e.g. Microsoft Outlook, Mozilla Thunderbird, etc.), which will move the emails identified as spam e.g. to a special folder.

  We provide some examples of the filter setup in popular e-mail clients. With it, you have the option of sorting the e-mails checked by eXpurgate in your email client.

  By using the eXpurgate options you may determine the handling of emails in each category indiviually. For example you will be able to have all mails categorized as"spam" sent to a special email address.

  To access these options please log into my.Eleven.de by using your username and password. You will find detailed guides to the filter options in our support section.

• eXpurgate Email Categories   

  The eXpurgate spam filter and e-mail categorisation service reliably categorises all incoming e-mail and currently sorts it into 16 different categories.

  Categorisation is normally carried out by adding an entry to the e-mail’s header. Based on these entries, the e-mails categorised by eXpurgate can then be sorted appropriately by any conventional e-mail program by setting up filters.

  Customers can individually define how e-mails in each category are to be handled. For example the customer can specify that spam is to be forwarded to a separate central e-mail address (see Instructions for configuring the eXpurgate service).

  CONFIGURATION OPTIONS FOR EACH INDIVIDUAL CATEGORY INCLUDE THE FOLLOWING:

  • Specifying which e-mail address the e-mails in each category should be forwarded to
  • Adding customised headers
  • Deleting headers
    Modifying subject headings
  • Same procedures for different categories

  THE MOST COMMON E-MAIL CATEGORIES ARE:

  • clean: e-mail with no suspicious characteristics. chief among these are individual e-mail messages sent from a single sender to one or very few recipients.
  • bulk: legitimate, mostly welcome mass e-mails. Chief among these are newsletters that were requested or ordered by the recipient or they have in some other way explicitly agreed to receive.
  • Spam: e-mail unambiguously identified as spam or phishing. Aside from unwanted advertising e-mail (spam), phishing e-mails that prompt the recipient to reveal confidential data such as passwords, for example, also belong to this category

• Complete list of eXpurgate email categories   

  The categorisation of e-mails by eXpurgate is archived by adding additional information to the header of an e-mail. According to this information e-mails may be sorted in an appropriate manner by using rules defined in any usual mail client.

  Each email checked by eXpurgate is assigned one of the following categories:

  • clean: emails with no suspicious features
  • bulk: mass mails such as newsletters
  • bulk.advertising: advertising emails that are not typical Spam, but are usually deemed to be a nuisance
  • bulk.porn: emails containing pornographic material, but which are not Spam (e.g. pornographic newsletters)
  • Spam: email definitively identified as Spam or phishing e-mail
  • suspect: emails suspected of being Spam or "bulk"
  • dangerous: emails which may include dangerous self-executing code or attachments with these features
  • dangerous.attachment: emails containing an executable attachment
  • dangerous.code: emails containing potential dangerous content, e.g. references to local files
  • dangerous.iframe: emails using the iframe feature
  • clean.empty: emails containing no content at all, neither in the subject nor in the body
  • clean.empty-body: emails with a completely empty body
  • clean.almost-empty: emails with a extremely short body
  • clean.bounce: emails returned back to sender due to an error

  If the optional "virus check" is activated, emails containing viruses are marked as:

  • dangerous.virus: emails containing a virus
  • dangerous.virus-outbreak: Emails, that are most likely to contain a new virus not yet recognized by virus detection due to the newness of their debut

• Changing the delivery address   

  You can specify a separate e-mail address for each individual category (Spam, bulk, clean, etc.).

  To do this, please proceed as follows:

  1. Select the email category for which you wish to change the delivery address from the top dropdown menu.
  2. Then click the "Select" button.
  3. In the "Deliver to" line, please click the "Edit" symbol.
  4. Then enter the new email address, which actually belongs to you, and click "Save parameter".

     If you want to change your delivery address for other categories, or wish to make other settings, please return to point 1.

  5. To save your changes, click the "Save all" button.
  6. In the event that the system is not familiar with the new forwarding address, the following message appears:

     A verification e-mail is then sent to the new e-mail address - as was also the case following your initial registration. This is intended to certify that you are actually the owner of the new address.

• Adding headers   

  1. Select the email category for which you wish to add a header from the top dropdown menu.
  2. Then click the "Select" button.
  3. In the "Deliver to" line, please click the "New rules" symbol to add an action.
  4. You can now write your own header in the empty box.

     If you want, you can use the variables suggested by eXpurgate. Please remember that the new header must be complete.

     Then click the "Add action" button.

     

     With this example, the email header reads as follows:

     For corporate users:
     user-11: ATTENTION Spam sent to user-11@mydomain.com

     For private users:
     user-11: ATTENTION Spam sent to user-11@spamfence.net

  5. To save your changes, click the "Save all" button.

     Now you can introduce additional settings as you see fit.

     IMPORTANT: The "Discard changes" button cancels all modifications made to the email type in question.

• Deleting headers   

  1. Select the email category for which you wish to delete a header from the top dropdown menu.
  2. Then click the "Select" button.
  3. If you wish to delete a header which you added yourself, it will appear in the current window and all you need to do is click the delete symbol.

     Then click the "Save all" button.

  4. If you wish to delete a different header, please click the "New rules" symbol in the "Deliver to" line.
  5. Then click the marking to the left of the "Remove header" line.
  6. Now enter the header you wish to remove – please only enter the part before the first colon.

     Then click the "Add action" button.

     

     In this example, all headers beginning with "example:" will be removed for the "Spam" email type.

  7. To save your settings, please click the "Save all" button.

     Now you can introduce additional settings as you see fit.

     IMPORTANT: The "Discard changes" button cancels all modifications made to the e-mail type in question.

• Changing the subject header   

  1. Select the email category for which you wish to change the subject header from the top dropdown menu.
  2. Then click the "Select" button.
  3. Please click the "New rules" symbol in the "Deliver to" line.
  4. Click the marker next to the label "Write subject header to".
  5. Now enter the information you wish to appear in future subject headers.

     Then click the "Add action" button.

     

     In this example, the category is to be inserted as a prefix to all subject headers for the "Spam" e-mail type:

     [Spam]: Original subject 

  6. To save your settings, please click the "Save all" button.

     Now you can introduce additional settings as you see fit.

     IMPORTANT: The "Discard Changes" button cancels all modifications made to the e-mail type in question.

• Using identical settings for different categories   

  With this function, clients can specify that one email type is to be handled in exactly the same way as another. Please note that this also involves copying the entire eXpurgate header information from one category to another, thereby overwriting the old eXpurgate header. However, prior to implementing this action, you have the option of introducing additional rules for the email types in question. For example, you have the opportunity to add your own headers which, despite the equal treatment function, will still be displayed in the future. This allows users to continue to differentiate between email types.

  This function and the "Deliver to" rule are mutually exclusive. To change this, you need to delete the exclusionary rule first.

  1. Select the email category which you wish to have treated in the same way as another category from the top dropdown menu.
  2. Then click the "Select" button.
  3. Now delete the "Deliver to" rule by clicking the delete symbol.
  4. In the next window, please click the marking to the left of the "Handle this email type as" line.
  5. Please now select the desired category from the dropdown menu.
  6. Then click the "Add action" button.

     In this example, the "dangerous" e-mail type is to be treated in the same way as Spam in the future.

  7. To save your settings, please click the "Save all" button.

     Now you can introduce additional settings as you see fit.

     eXpurgate's default setting treats the "bulk.advertising" and "bulk.porn" categories in the same way as Spam. You need to delete this rule prior to changing this setting.

     IMPORTANT: The "Discard Changes" button cancels all modifications made to the e-mail type in question.

• The eXpurgate header information   

  You will find an additional "X-purgate"-header pasted in each e-mail during the check procedure. Depending on the result of the check the header will carry amongst other things the following information:

  identified as Spam:

  X-purgate: This mail is identified as Spam
  X-purgate: spam

  Emails sent in a way typical for newsletters, lists, chain letters and sometimes even for joke-mails or so-called "opt-in infomercials" (i.e. sent to many recipients):

  X-purgate: This mail is sent in bulk
  X-purgate: bulk

  E-mails having partly suspect content typical for Spams, but which do not meet the 'sent in bulk'-criterion:

  X-purgate: This mail is considered suspect
  X-purgate: suspect

  Important: The 'suspect' category is not equal to 'Spam' !
  Private e-mails may also contain some 'suspect' content, so we suggest not to automatically delete e-mails marked like that !

  "clear" e-mails will carry an additional header with the following information:

  X-purgate: This mail is considered clean
  X-purgate: clean

  NEW: Additionally, bounce e-mails are tagged with the header:

  X-purgate-type: clean.bounce

  Furthermore Eleven will mark potentially malicious e-mails, which contain e.g. executable codes - codes which could start actions without the approval of the user by just displaying the e-mail in the preview window - with the following additional header information:

  X-purgate: This mail contains potentially dangerous content
  
  		X-purgate: dangerous

  Some types of potentially dangerous e-mails are marked with the following subcategories:

  X-purgate: This mail contains potentially dangerous content
  
  		X-purgate: dangerous
  
  		X-purgate-type: dangerous.code

  X-purgate: This mail uses potentially dangerous features
  
  		(IFRAME-Tag)
  
  		X-purgate: dangerous
  
  		X-purgate-type: dangerous.iframe

  X-purgate: This mail contains potentially dangerous
  
  		attachment
  
  		X-purgate: dangerous
  
  		X-purgate-type: dangerous.attachment

  The last mentioned category will be used to mark e-mails, which have an executable file attached. Please note, that we do not check attachments for viruses.

  To check e-mails against viruses, you can optionally activate the "Virus Check". E-mails containing viruses are marked as:

  X-purgate: This mail contains a virus
  
  		X-purgate: dangerous
  
  		X-purgate-type: dangerous.virus

  There are two more categories: 'bulk.advertising' and 'bulk.porn'. The first one characterizes commercial e-mails which are - contrary to their appearances - no Spam, but which are usually not wanted.

  'bulk.porn' characterizes all circular e-mails with pornographic content, which are no typical Spam as well (e.g. pornographic newsletter).

  Both categories are subcategories of 'bulk'. But in the default setting we handle those e-mails as Spam. As a matter of course you can change the settings.

  In the default setting the header information looks like this:

  X-purgate: This mail is identified as Spam
  
  		X-purgate: Spam
  
  		X-purgate-type: bulk.advertising

  respectively:

  X-purgate: This mail is identified as Spam
  
  		X-purgate: Spam
  
  		X-purgate-type: bulk.porn

  If you change the default settings the header information looks like this:

  X-purgate: This mail is sent in bulk
  
  		X-purgate: bulk
  
  		X-purgate-type: bulk.advertising

  respectively:

  X-purgate: This mail is sent in bulk
  
  		X-purgate: bulk
  
  		X-purgate-type: bulk.porn

  In addition to this empty or almost empty e-mails are marked with the following headers:

  X-purgate: This mail is empty
  
  		X-purgate: clean
  
  		X-purgate-type: clean.empty

  X-purgate: This mail is almost empty
  
  		X-purgate: clean
  
  		X-purgate-type: clean.almost-empty

  X-purgate: This mail has an empty body
  
  		X-purgate: clean
  
  		X-purgate-type: clean.empty-body
  		

  clean.empty are e-mails containing no content at all, neither in the subject nor in the body. Because these e-mails are as unwanted as spam in the default setting we handle those e-mails as Spam.

  In the default setting the header information for this category looks like this:

  X-purgate: This mail is identified as Spam
  
  		X-purgate: Spam
  
  X-purgate-type: clean.empty

  The method mentioned above allows to define a filter for your e-mail client (eg. Microsoft Outlook, Eudora etc.) that will respond during the test stage to this additional header information and will move the identified e-mail in a special folder (e.g. SpamTest).

  We provide Instructions for several e-mail clients on how to set up filtering have generated instructions, which will help you by setting up these filters.

  Our configuration tool gives you the chance to add your own header for each category. By sending some e-mail types to different e-mail addresses you can relieve your mailbox completely from Spam and other undesirable e-mails.

• Changing the MX record   

  For using the eXpurgate ASP service, your nameserver configuration needs to be modified.

  Please modify the MX records of your domain(s) from:

  [...]
      IN      MX 10   YourMX.YourDomain.com.
      IN      MX 50   YourBackupMX.YourDomain.com.
  [...]

  to:

  [...]
      IN      MX 10   mxA.expurgate.net.
      IN      MX 10   mxB.expurgate.net.
      IN      MX 10   mxA.expurgate.de.
      IN      MX 10   mxB.expurgate.de.
  [...]

  If you use TLS, please change the MX records as follows:

  [...]
  
  mxtls.expurgate.net
  
  [...]

  With this modification an external email sent to an addressee in your domain will not be delivered directly to your mail server anymore. Before the final delivery, the email will be routed through the eXpurgate server, where it is checked.

  Please do not change these until Eleven has confirmed the activation in the eXpurgate system. Otherwise emails can be lost.

  Important hints:

  1. Please do make sure to configure your mail server to "feel responsible" for the domain, regardless of the entry in the MX record, i.e. to accept all emails and to deliver them locally.
  2. After you changed the configuration, it may still take some time for the new name server entries to spread over the complete internet.

  Please don't forget to update the 'serial' (SOA record in the name server's zone file) and restart your name server, after making changes to the name server configuration.