Spam and virus filtering
How WebGee filters inbound mail with MailScanner and SpamAssassin, what the Spam and Disarmed subject tags mean, and which attachments are blocked.
How WebGee filters inbound mail. Applies to every mailbox on shared, reseller and Workspace plans. Filtering is on by default and there is nothing to enable.
Every incoming message is scanned by MailScanner for viruses and dangerous attachments, then scored by SpamAssassin.
What happens to a message
| SpamAssassin score | Result |
|---|---|
| Low | Delivered normally |
| Probably spam | Delivered, with {Spam?} added to the subject |
| Almost certainly spam | Rejected — not delivered at all |
Tagging rather than quarantining is deliberate: nothing borderline is held somewhere you have to remember to check. You can filter on the tag in your mail client or in webmail under Filters.
The {Disarmed} tag
{Disarmed} in a subject line means MailScanner removed something risky from
the message body while delivering the rest. Two things trigger it:
- Web bugs — tiny tracking images used to detect whether you opened a message.
- IFrames — historically an attack vector against Outlook. They are also common in legitimate mailing lists, which is why these messages are disarmed rather than rejected.
The message is safe to read. Some formatting may be missing.
Blocked attachments
Messages carrying certain attachment types are rejected regardless of their spam score, because the file type itself is the risk.
Executables and scripts: .exe, .com, .bat, .cmd, .scr, .pif,
.vbs, .vbe, .jse, .sct, .hta, .cpl, .job, .reg, .scf, .shb,
.shs, .lnk, .ins, .cnf, .vsmacros
File types with a history of buffer overflows: .ani, .cur, .ico,
.bmp, .chm, .hlp, .its, .mhtml
Office and data files flagged by Microsoft: .mad, .maf, .mag, .mam,
.maq, .mar, .mas, .mat, .mau, .mav, .maw, .mda, .mdz, .prf,
.pst, .tmp, .vss, .vst, .vsw, .ceo
Messages are also rejected when a filename:
- is longer than 150 characters,
- contains more than 10 consecutive spaces, or
- hides its real extension behind a CLSID, such as
report.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}.
All three are techniques for disguising an executable as a document.
Send a blocked file type anyway
Put it in a password-protected archive, or share it by link from cloud storage. Do not rename the extension — the filter inspects file contents, not just the name, and a renamed executable is still rejected.
If legitimate mail is being tagged
See Why are my emails being marked as spam?, which covers both receiving and sending.
For adjusting thresholds on your own domains, see Configure MailScanner in cPanel.