Content Examination - Spam / Phishing - Backscatter Prevention

This article contains information on backscatter spam, its causes, Mimecast's security checks, and the inability to create custom regular expressions for Content Examination to block such messages.

Overview

Backscatter is incorrectly automated bounce messages, sent by mail servers as a side effect of inbound Spam messages.

• Our security checks use a combination of reputation, RFC conformity, and content-based checks. We do not write custom spam rules.
• Our spam engines perform security checks on message content received from null addresses, such as anomalies with the character set. They often get blocklisted, and fail reputation checks.
• If users are targeted by backscatter spam, a Content Examination check using a regular expression must be created to block the messages.

Mimecast does not support the creation of custom Regular Expressions that are used in a Content Examination Definition.

To configure Content Examination, see Content Examination - Configuring.

See Also... 

• • • Content Examination - Configuring
    • Content Examination - Definitions
    • Policies - DNS Authentication Overview
    • Policies - Null Address In Policies