First, incoming email sent from a listed IP address can be dropped at SMTP connect, saving storage and processing costs. You have the choice to block, accept, or quarantine messages according to your company policy.
When an email is blocked, the sender will immediately receive a notification, ensuring that emails do not lie unread in junk folders for weeks.
After blocking unwanted emails during the SMTP transaction, the remaining traffic can then be filtered by content utilizing our low reputation domains, low reputation resources, and zero reputation domains datasets.
This staged process is considered best practice:
- Remove obvious spam sent from known botnets and spammers’ IP addresses and domains.
- Detailed analysis to identify emails containing malware or links to new websites that are controlled by spammers and cybercriminals.
Read “Where to apply blocklists for effective email filtering” for further details.