Spam Confidence Level (SCL)

This example is based on the following filter configuration:

• Emails should be checked and rejected as soon as the SCL is greater than or equal to 4.
• Three filters are activated: Realtime Blocklists, Spam URI Realtime Blocklists and the word matches.
• The Word Matches filter is configured to search for the words Sex, Viagra, Cialis, etc. and to give two penalty points per hit.
• The two block list filters should give two points per hit.
• Level of Trust is switched off.

Now an email containing eight forbidden words and one forbidden link is processed. The link is included in a blacklist. Furthermore, the submitting IP address is represented on two blacklists.

Preliminary filter result

Filter	Spam Confidence Level
Realtime Blocklists	4 (Two hits times two penalty points per hit)
Spam URI Realtime Blocklists	2 (One hit times two penalty points per hit)
Word matches	16 (Eight hits times two penalty points per hit)

Basically, all filters - including the Level of Trust - always truncate the determined value to 10 if it is greater than 10. For negative values that are smaller than -10, the value is adjusted to -10.

"Net value" of the filters

Filter	Spam Confidence Level
Realtime Blocklists	4
Spam URI Realtime Blocklists	2
Word matches	10 (limited because the first value was >10)

Finally, the multiplier of the individual filters is taken into account. The filter Realtime Blocklists and Spam URI Realtime Blocklists have a multiplier of "2", the word matches have a multiplier of "1". The net value of the filters is now multiplied by the respective multiplier.

"Net value" and multiplier

Filter	Spam Confidence Level	Multiplier	SCL
Realtime Blocklists	4	2	8
Spam URI Realtime Blocklists	2	2	4
Word matches	10 (limited because the first value was >10)	1	10
Total			22

The email therefore receives an SCL of 22 and is thus rejected.

In this example, the filter configuration from the first example is extended by the Level of Trust. It is the same email as in the previous example. However, we assume that this is a wanted email and that there is already an address pair and a domain bonus in the database from the sender and recipient address.

• Since the last email contact was already four days ago, the address pair bonus with 65 bonus points is not as high anymore. The domain, on the other hand, is trusted with a static 100 bonus points.
• The bonus points of the Level of Trust in the database are not directly the SCL value, but the so-called trust points. These are only used within the filters.

Evaluation by Level of Trust

Existing negative values as well as positive values are included in the calculation of the Level of Trust. Negative values can be caused, for example, by the intelligent DSN check or manually set values. In principle, negative values then take precedence over positive values. So if an email had received +100 trust points for the domain, but had been assigned -5 trust points for other reasons, these -5 trust points would be used as the basis of the weighting.

To calculate the SCL, the resulting value is then divided by the value -10 and results in an SCL of -10 points in this example. As with all other filters, the determined value is clipped to 10 or -10. The table with the net values of all filters now looks as follows:

Filter	Spam Confidence Level
Realtime Blocklists	4
Spam URI Realtime Blocklists	2
Word matches	10 (limited because the first value was >10)
Level of Trust	-10

You can define the multiplier of the individual filters in the respective rule. The Level of Trust, on the other hand, determines its multiplier independently. For this purpose, the multipliers of all other filters are added and result in this example in the value 5.

Result from Spam Confidence Level and Level of Trust

Filter	Spam Confidence Level	Multiplier	SCL
Realtime Blocklists	4	2	8
Spam URI Realtime Blocklists	2	2	4
Word matches	10 (limited because the first value was >10)	1	10
Level of Trust	-10	5 (=2+2+1)	-50
Total			-28

The email would have been delivered in this example because the SCL is less than 4. To clarify the example, the Core Antispam Engine filter is also configured with the multiplier "3". This filter always assigns 4 points for a hit and this value is also not configurable.

The Core Antispam Engine filter also rates the email poorly.

Final result of the SCL calculation

Filter	Spam Confidence Level	Multiplier	SCL
Realtime Blocklists	4	2	8
Spam URI Realtime Blocklists	2	2	4
Word matches	10 (limited because the first value was >10)	1	10
Core Antispam Engine Filter	4	3	12
Level of Trust	-10	8 (=2+2+1+3)	-80
Total			-46

The multiplier of Level of Trust has automatically adjusted itself through the additional filter and can therefore have a greater impact on the result. This ensures that intended communication always reaches the recipient - regardless of the content of the email.