If the spam engine is doing its job properly, you don't have to look deep into the innards. This is a mixed blessing.Ĭorporate managers are moving away from tuning systems at this level because it's really not important. Both let you dive in and touch every aspect of the spam matching.
![how to manually remove sophos puremessage how to manually remove sophos puremessage](https://support.home.sophos.com/hc/article_attachments/115018109523/1.png)
If you want to see the rules used to match spam and edit them, then Sophos' PureMessage and Messaging Architects' GWGuardian are your best choices. But having Viagra in the subject, in the body two or three times, a Web site URL of an online pharmacy and having the message come from the IP address of a suspected spammer all add up to the message being spam. For example, just having the word Viagra in the subject line of a message does not make it spam. In our tests, products that let one test dominate the score - have only one test - tend to have a high false-positive rate. In this market, the strategies each vendor uses to classify spam are in rapid flux as they search for better ways to outfox the spammers. The proof of what works well (and what doesn't) comes out of the statistics on false positives and false negatives.
![how to manually remove sophos puremessage how to manually remove sophos puremessage](http://bent-blog.de/wp-content/uploads/2013/07/iis-app-quarantine.png)
In our evaluation, we decided to not go down the path of evaluating the components of the cocktail. Many vendors sent elaborate white papers explaining how their spam cocktail was mixed to be superior to the competition. When enough tests agree (or when a single test gets a high enough score), the message gets its verdict: spam or not spam. As the SpamAssassin team puts it when describing their anti-spam cocktail, "While any of these tests might by themselves mis-identify a message, their combined score is terribly difficult to fool." To implement the cocktail, each message runs through multiple filters or tests, and receives a set of scores. Modern products mix the results from multiple tests and analyses, combining and weighting them to come up with a final answer for each message. Early spam products had only one technique, such as searching for words in headers of message bodies, or a set of techniques that each could torpedo a message as spam. The term "cocktail" is used by anti-spam vendors to explain how they make the go/no-go decision on spam.