These reports are all based upon the IP address as the principal criteria. Pressing this report button brings up the following display.
There are several useful reports available, all ordered in decreasing frequency according to the date range specified below. Click on the links provided in the Report column to see a sample of that report.
|
Report |
Description |
|
Shows the source of spammers using the Reverse NDR attacks to make your mail server into an indirect relay. | |
|
Shows the mail hosts filtered by the SMTP protocol level DNSBL test, if enabled. | |
|
Shows the mail hosts filtered by the message level DNSBL test, if protocol level is not enabled. | |
|
Shows the mail hosts whose messages were caught by Praetor's rules. |
This is one of the most useful reports available as it shows the overall statistics for messages organized by the ultimate disposition (accepted, rejected, quarantined, etc.) as its main category, and the rules as the subcategory. Thus, at a glance you can see how much spam you are getting, and how much is being caught by DNSBL or the Bayesian filter.
Pressing this button will display the following selection screen.
From here you can choose the time period and domain for the analysis. Leaving the domain field blank will analyze across all declared domains. Here is a sample excerpt of this report.
In the above sample, 31% of the mail arriving were quarantined and the approved number of 0.03% represents the false positives which are good messages that were caught as spam.
When the Reverse NDR rule enabled, the amount being reported under the REJECTED events (not shown above) with that rule name will indicate if you are under attack. The number reported will be very high if your site was under heavy Reverse NDR attack, and you should use the special Reverse NDR report to determine the source IP addresses that are the major launch points of the attack. That way you can put on your local blacklist in the IIS SMTP Server Connection control settings found on the Access tab of the Default SMTP Server properties.