The AlwaysOn Mail Filter is a hosted email gateway server incorporating a comprehensive Spam and Virus filtering solution that ensures all email arriving at your mail server and network is Spam and Virus free. It has helped hundreds of enterprises enormously reducing the amount of incoming spam and virus messages. 
How the Mail Filter Works
AlwaysOn Mail Filter system provides an integrated Anti-Spam and Anti-Virus solution offering complete email protection at the “network perimeter” level, before unwanted or potentially dangerous and costly email reaches your network or mail server.
When an email message is received by the AlwaysOn Mail Filter system it is subjected to multiple layers of email filtering and defense. First, the system runs several connection control and validation tests to determine whether connecting mail servers are valid sources of Internet email.
Connection Control/Validation
These tests include the verification of parameters such as the “MAIL FROM” address as well as the HELO/EHLO domain information. The system also performs reverse DNS lookups for each message to ensure that the domain associated with the sender address is valid and resolving.
RBL/Blacklist checks
RBL/Blacklist checks are then carried out to see if the IP address or domain of the connecting sender is associated with a known Spam sender, open mail relay or other recognized source of Spam and/or Virus laden email. The scanner system features local blacklisting capabilities that allow you to specify any IP address, domain or email address to reject connections or email messages from.
Connections from blacklisted IP addresses, domains or email addresses are rejected immediately. This results in reduced load on the server and on the receiving email server as well as increased capacity for the expedient processing of other email.
Anti-Virus Scanning
Email messages which make it past the Connection Control and Validation stage and which pass all RBL/Blacklist checks are then subjected Anti-Virus scanning.
All email messages are checked against a database of over 100, 000 virus definitions. Our filter server automatically receives multiple updates of Virus definitions up to several times per hour providing up to the minute defense against the latest virus and worm threats ensuring effective and accurate virus protection.
If a virus or other dangerous attachment is detected, the system will disinfect the contents of the email and deliver the message to either the Virus Quarantine mailbox or to any other offsite email address specified in the control panel. The administrator can then decide if suspect attachments should be stripped/cleaned and then forwarded with notification to the end user recipient or deleted from the quarantine.
Whitelisting/Delivery
Email messages that make it past the Connection Control and Validation, RBL/Blacklisting and Virus Scanning stages are then checked to see if they are contained in the system Whitelist. A “whitelisted” email address or domain is an address or domain from which email is always accepted regardless of how it scores with respect to Spam or other undesirable content. If a message is associated with an email address or domain contained in the system Whitelist it is ?passed clean? and delivered immediately to the intended recipient.
Spam Scanning and Filtering
The Spam Scanning and Filtering engine on our filter server incorporates an extensive rule-based scoring system which determines whether a particular e-mail message is spam or not-spam. The server system examines the content of each message received and assigns it a “spam level” score according to how much a “looks like” Spam based on a comprehensive set of rules and algorithms derived from analyzing millions of known Spam messages.
Thousands of rules are run against every email message in the space of a few milliseconds. A complex algorithm optimizes the rule-based scoring by using an archive of millions of spam and non-spam messages to determine the scores for the individual rules. When combined, these individual scores give each email an overall “Spam Scoring Level”.
When a potential Spam message is detected by the system the message is either “tagged” with the **SPAM** tag and forwarded on to the recipient, or blocked from delivery. The decision of delivery of a mail which reached or passes Action Level score is also customizable.
In addition to Spam Scoring Level control the Spam Scanning and Filtering engine of our filter server also incorporates a number of automatic “self-tuning” and “auto-learning” mechanisms including Bayesian Analysis and Learning which are able to automatically increase accuracy and sensitivity of the system over time.