Purpose of CanIt-PRO
Unsolicited commercial e-mail (UCE), or spam is a pervasive problem. More and more unwanted messages are clogging mail servers and wasting employees’ time. CanIt-PRO is a piece of software which runs on our mail server, scanning e-mail messages and picking out those which it considers to be spam. Messages identified as spam are held until you examine them, and mark them as definite spam, in which case they are discarded, or as legitimate messages, in which case delivery is permitted. After five working days, any unexamined email is assumed to be spam and is discarded.
How to access CanIt-Pro
The web interface for CanIt is used for all functions related to your anti-spam filter. To access the web interface go to https://canit.westga.edu/ and log in with your complete email address e.g. email@example.com or firstname.lastname@example.org and your current email password.
Q: What is the difference in Puremessage versus CanIt-Pro vocabulary?
A: What Puremessage called “quarantining” a spam message, CanIt calls “trapping”. Puremessage sent a “Quarantine Digest” to let you know which email messages it had detained. CanIt sends “Notifications”.
Q: Will CanIt send an email notification of my spam, like PureMessage did?
A: By default CanIt will notify you twice daily of trapped messages at 7am and at 4pm. The CanIt notification email will not allow you to click on a spam message to release it from the spam trap. Instead you will interact with CanIt via the web interface at https://canit.westga.edu/. You can change your notification settings by clicking on the Preferences tab, then the notification tab and then selecting the times of day you would like to be notified.
Q: How will I see my spam messages now?
A: You will have to log into CanIt to see your spam trap. For faculty/staff, your login will be your complete email address (email@example.com) and your password will be the same as your email password. For students, your login will be your complete email address (firstname.lastname@example.org) and your password will be the same as your myUWG password.
Q: Do I have to do anything with the "Spam" or "All" part of the Trap?
A: No, this is simply the mail that has been marked as Spam (or in the case of All, everything in the system that it thinks is spam until you do something with it) and is automatically purged; anything older than 5 days is removed.
Q: What is a blacklist? What is a whitelist?
A: A blacklist is a list of "bad" addresses or domains to refuse email from, a whitelist is a list of "good" - or known - addresses or domains to accept email from. You can have a list of these that alter how mail is delivered to you.
Q: Can I make it so mail from a specific sender always gets through or is always blocked?
A: Yes. If an email from a sender is in your trap, you can click on that email address and select the desired action. To add an address when you don't have an email in your trap, you would click on the “rules” tab, then the “senders” tab and enter the email address in the field provided. Then click “add rule” and select the desired action. Remember to click the “submit changes” button after making any changes to your CanIt preferences.
Q: Can I make it so mail from some domains always gets through or is always blocked?
A: Yes. If an email from a sender is in your trap, you can click on the domain portion (i.e.spammer.com) of the email address and select the desired action. To add a domain when you don't have an email in your trap, you would click on the “rules” tab, then the “domains” tab and enter the domain in the field provided. Then click “add rule” and select the desired action. Remember to click the “submit changes” button after making any changes to your CanIt preferences.
Q: What is a Spam Threshold?
A: As it relates to the system, it is a score assigned to a piece of mail; this score is based on a set of rules that mail is checked against for known spam issues. The lower this threshold, the lower the score has to be before something is marked as "Spam." While the spam score can vary from 0 to 1000 or more, a spam threshold of 6.5 is considered quite lenient, while 3.5 would be considered very strict.
Q: What is a good Spam Threshold to set initially?
A: After careful study and consideration, it has been determined that the default setting captures the most spam, with the least false positives. We recommend leaving this at first and after a time, adjusting it to your personal needs. We have found that most people know approximately where to set it within about a week.
Q: Why is some spam still getting through? What do I do with spam that still gets through the trap?
A: Spam is a moving target, and fighting spam is a very difficult prospect. Often a spam gets through, but has a score. You might examine the headers of this spam to see if it did get scored, and if so possibly adjust your Spam Threshold. Another action you can take is to vote on the email to help it train our local spam detection engine. To do this, locate the links at the bottom of your email to vote “Spam”, “Not Spam”, or “Forget previous vote”. When you click on one of these links you will be taken to the CanIt web interface and if you have not already logged in, you will be prompted to do so. Voting the message as Spam does not blacklist the sender. It merely improves the chances of detecting similar messages in the future. If you wish to blacklist the sender or the domain refer to the questions above.
Q: Can I block spams with the same subject line or based on words in it? a.k.a I don't want to get any spam with the word "Cialis" in it!
A: Yes but this is not always reliable because spammers tend to distort spelling of the key words. To create a custom rule, click the “rules” tab, then the “custom rules” tab. Select the part of the message you wish to check by using the “field” selection box, e.g. “subject”. Then choose the “relation” you wish to test, e.g. “contains”. In the “data” field enter the word or phrase to detect, e.g. “cialis”. Custom rules do not act to blacklist, instead you provide a modifier to the spam score which is applied when a match is detected. You can supply a very high score modifier. e.g. 2000 if you wish to ensure that all messages that match will be blocked. Supply the spam score modifier in the “score” field and click “add rule”. Custom rules are very powerful and can result in unanticipated matches which may block legitimate email. Please use care when creating custom rules.
Q: Can I opt out of anti-spam processing?
A: Yes. Simply log in to CanIt, click the “preferences” tab, then the “opt in/out” tab and click the button to opt out of spam scanning. You can always reverse this later if you choose.
Q: What if I wish to filter my mail locally?
A: CanIt supports tagging emails with spam score for easy local processing. If you would prefer for CanIt to deliver all of your mail with a spam score added to the subject line rather than trapping, then log in the CanIt, click the “preferences” tab, then the “set default stream” tab and select from the drop down box “only tag my spam with a score in the subject line” and click “inherit from this stream”.
Q: How do I adjust CanIt settings for an email alias which belongs to me?
A: If you have a regular email address and one or more additional aliases, you can inform CanIt that the alias address(s) belong to you. To add an alias as an alternate address, log in to CanIt and click the “Preferences” tab, then the “Alternate Addresses” tab. Enter the alias address as instructed and click “Add address”. The server will send a confirmation email to the alias address. Once the confirmation is complete, your alias will be tied to your email address. Please note: if an alias is used as a distribution list, only the “owner” of the list should add the alias as an alternate address.
Q: How can I reduce the amount of spam that I am asked to approve?
A: Each spam message has a "score", and you can configure Canit to auto reject messages that exceed a certain score. By default, Canit auto rejects messages with a spam score of 2000. You can fine tune this to reduce the amount of spam that you are asked to approve. To do this simply log in to CanIt, click the “preferences” tab, then click on the "stream settings" tab. The field you are looking for is "Automatically reject messages scoring more than this amount". You may wish to look at your spam contents and see what the common number for the spam that you receive is, and set this option to be lower. For example, if most of your spam scores around 35, it would be a good idea to set this option to 30.
We use many terms related to Internet e-mail in this manual. Here is a definition of some of the terms we use.
Blacklist - A list of domains, senders or hosts that are blocked from sending e-mail.
CanIt-PRO is an enhanced version of CanIt that allows flexible delegation of spam-control responsibilities rather than requiring a single spam-control officer.
Envelope - Mail messages often have headers specifying the sender (the “From:” header) and recipients (typically the “To:” header.) However, SMTP has a completely separate set of commands for specifying the sender and recipients. The sender and recipients specified in the SMTP commands are referred to as the envelope sender and envelope recipients, and do not necessarily match the information in the message headers. CanIt-PRO always uses the envelope sender and recipient addresses in its rules. CanIt-PRO — Roaring Penguin Software Inc.
Relay Host - When a mail server wishes to transmit e-mail to your server using SMTP, it establishes a connection with your mail server. The machine attempting to transmit mail to your server is called a relay host.
Sender’s Domain -This is the domain part (everything after the @ sign) in the sender’s e-mail address.
Spam Score - A numerical score computed by CanIt-PRO that rates the likelihood that a message is spam.
Stream - is a “virtual CanIt” machine offered by CanIt-PRO. If an incoming e-mail arrives for more than one recipient, and the recipients each wish to have his or her own private spam trap, CanIt-PRO re-mails the original message so each recipient has his or her own copy, and can dispatch it as he or she sees fit.
Whitelist - A list of domains, senders or hosts whose e-mail is permitted through without spam-scanning.