How Spam Goblin Works
 
Spam Filtering
Solving the Problem
In order to win the war against spam, businesses must evolve their spam defenses faster than spammers evolve their techniques.

Our Spam Filtering Solution accomplishes this by gathering real-time spam intelligence from a number of sources and then actively using this intelligence to block the spam. We track tens of thousands of live spam email signatures which alone identify the majority of spam. In addition, a number of third-party spam databases, several DNS checks, and several message-formatting tests are used when analyzing each email. We also have a staff of highly trained individuals who manually comb emails to ensure that we are providing the best filtering solution possible.

We aggregate all of this data into a collection of several thousand constantly evolving spam tests that are performed on every email that enters the email hosting system. The results of these tests are combined together to identify more than 98% of spam with virtually zero false-positives.
 
Virus Scanning
Restricted Attachments
Emails are searched for dangerous types of file attachments. Dangerous files are those that contain executable code, which can be used by malicious persons to spread viruses or do harm to your computer. Restricted file types include, but are not limited to program files (.exe, .com), script modules and files (.bas, .vbs, .js), Internet links (.url, .ins), and shortcuts to files (.lnk, .pif). When an email is sent or received that contains a restricted file attachment, the email is rejected and the sender receives a "bounced" email notification informing them of the restriction.

Normalization
This stage searches for email formatting vulnerabilities that can be used by viruses to hide from virus scanners. If any vulnerability is found, our system corrects the formatting of the message so that it can be thoroughly scanned for viruses. This is called "normalizing" the message, and most notably this process protects against all known Microsoft Outlook security threats.

Decompression
Next, if the email contains any compressed attachments such as zip files, the compressed attachments are temporarily unzipped so that the contents can be scanned for viruses. Many of today's viruses use compression as a way to sneak their way past virus scanners. This elevates that risk. If the attachment cannot be decompressed, such as the case with password protected zip files, the original file is scanned for virus signatures that occur in compressed attachments.