Formal Tests

don't rely on the content.

First of all we use Nolisting (aka "Poor Man's Greylisting").

Is the Recipient a Valid Email Address?

Does the email really come from an authorised server?

Is the Recipient a Valid Email Address?

All valid email addresses at TU Graz have to be registered via TUGonline
All valid email servers have to be reported

So the mailgates have to deal (spam, malware) only with emails for valid recipients.

Reputation check (SBRS)
Virus scan (Sophos)
Spam scan
Outbreak filter

If size is bigger than maximal size we reject the email.