Knowledgebase

Automatic User Locking

The user is automatically locked if any of the following situations occur:

• If any virus content is detected
• If more than one non-virus (e.g. phishing) message is detected within 24 hours.
• If the average score for messages sent by the user in the previous 24 hours exceeds a certain threshold
• If the average score for messages sent by the user in the previous hour exceeds a certain threshold
• If the average score for messages sent by the user in the last 10 minutes exceeds a certain threshold

Locked users

If the user is locked, then:

• A notification message is sent to the administrator
• Authentication succeeds, and the connection is processed as normal until DATA, when the message is temporarily (i.e. with a 4xx code) failed, with an error message indicating that the account is locked and the administrator must be contacted (providing the contact address from the API). Email to the administrator address is always accepted, even for locked users.
• The message is stored in the quarantine IMAP system, under the "global" user's account for review by the administrator

Unlocking users

Users may be unlocked:

• Automatically after a fixed period of time with a maximum of X times (configurable via the API)
• Manually via the API