McAfee MSA-3400-SWGI Installation Guide - Page 56

Troubleshooting FAQ • The email message might contain a virus or potentially unwanted program, and has been blocked by anti-virus scanning. Users are still receiving spam. Users might still receive spam for several reasons: • No anti-spam software can block all email messages that might contain spam. For the best chance of detecting and preventing spam, ensure that the appliance is using the latest versions of the anti-spam engine, anti-spam rules, and extra rules files, as well as using all the features that can block unwanted email. • The appliance is allowing streaming media to pass through. NOTE: Allowing streaming media to pass through the appliance is a security risk, because streaming media is not scanned by the appliance. McAfee recommends that you do not allow streaming media of type application/octet-stream or application/* to pass through the appliance because these MIME types are executable and are a security risk • Scanning for spam is not enabled on the appliance. Scanning must be enabled in the right direction for spam detection. To detect spam from an external source, enable inbound scanning. To detect spam from an internal source, enable outbound scanning. • You might need a more stringent anti-spam policy. For example, you might want to ensure that more email messages are marked as spam before they are received by users, or to simply block the spam at the appliance. • The email messages might be coming from senders, domains, or networks that are in the Permit Sender list. Review the list to make sure that you really want email messages from these senders to bypass anti-spam scanning. You might need to refine the entry in the list. For example, rather than permitting whole domains or networks, specify individual email addresses instead. • The mail client software does not automatically move unwanted messages into a spam folder, so users still see spam in their inboxes. • The email message might be larger than is permitted, so it is not scanned for spam. See your advanced settings for spam to change the size. • Email messages are not being routed through an appliance with the Anti-Spam Module enabled. How can I stop a particular type of spam? To ensure that you have the best chance of detecting and preventing spam, check that: • The appliance is using the latest versions of the anti-spam engine and anti-spam rules. • The appliance has not been configured to allow streaming media to pass through. Why has the performance changed? Scanning email messages for spam requires appliance resources and affects SMTP performance. Users are complaining that their mailboxes are full. If users automatically divert spam to a spam folder in the mailbox, their mailboxes can quickly exceed their size limit. Remind users to regularly check their spam folder and delete spam. 56 McAfee Email and Web Security Appliance 5.5 Installation Guide