---
type: concept
title: Email Spam and Virus Protection
tags: [email, security, filtering]
related: [central-email-service, phishing-prevention, ums]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_e_mail_spam_virenschutz.md"]
---

# Email Spam and Virus Protection

The email security framework at the Universität Greifswald, managed by the [[universitatsrechenzentrum-urz]], employs a "reject-at-gate" strategy to ensure the integrity of the [[central-email-service]].

## Technical Filtering Mechanisms
- **Greylisting**: An intelligent filtering method applied to incoming mail to deter automated spam bots.
- **Real-time Scanning**: All mail traffic—including incoming, outgoing, and internal university communications—is scanned for viruses and spam characteristics in real-time.
- **Non-scannable Attachments**: Files that cannot be inspected by the security software (such as password-protected archives or documents) are automatically rejected.
- **Immediate Rejection Policy**: Unlike systems that use quarantine folders or "spam" tags, the URZ system rejects non-clean emails immediately. The sender receives an instant notification of the delivery failure.

## Abuse Prevention (Ratelimits)
To mitigate the impact of compromised accounts being used for spam campaigns, the URZ enforces strict sending limits:
- **Volume Limit**: 200 emails per 24-hour period.
- **Recipient Limit**: 300 recipients per hour.
- **Identity Verification**: The system verifies that the sender's address corresponds to the authenticated account.

If a user exceeds these limits, they receive a "Rate Limit exceeded" error. These limits can be temporarily deactivated for 4 hours via the [[ums]] account settings.

## Operational Guidance
- **Local Filter Redundancy**: Users are advised to disable local spam filters. The URZ argues that because spam perception is subjective, local filters are more likely to introduce false positives (error identifications) than to provide meaningful additional protection over the central system.
- **Phishing Distinction**: A critical distinction is made between spam (mass mailings) and phishing (targeted attacks). Because phishing is targeted, it often bypasses mass-spam filters, requiring user vigilance and manual reporting to the URZ for the creation of specific filters.