Once Junk Spy finds a message it considers junk email, there are two options. The default is that the message header is flagged to indicate it's junk. You can use that header entry with your email program's filter capability to control what happens to it. You could delete it, move it to a specific folder, or take other action that your email program offers. If you don't want the message flagged, your other option is to have Junk Spy destroy the message completely. However, not all email programs can support this option and you do lose the flexibility of the filtering method. Consult the Getting Started guide for your email program for more information.

Messages that are not considered junk email are sent to your email program untouched.

What Is Junk Mail and What Isn't

2. Getting Started: Installation and Setup

• The actual installation of the program,
• Making sure TCP/IP is configured correctly with Junk Spy's TCP/IP Wizard, and
• Making a few changes to your email program.

Note that the TCP/IP Wizard is included in your Junk Spy folder as a separate function. That way you can use it at any time, not just during the installation and setup process. You'll find it can be useful if you make changes to your system which affect TCP/IP.

Configuring Your Email Program

• MR/2 ICE
• Netscape versions 2.02, 4.04, and 4.61
• Notes
• PMMail
• PMMail 2000
• Polarbar Mailer
• Post Road Mailer

If your program isn't included in this list, there are general instructions for configuring email programs to work with Junk Spy which you should follow.

3. Letting Junk Spy Work for You

As you can see, Junk Spy takes up minimal space on your desktop. At the same time, everything you need is right there at your fingertips.

Junk Spy's Message Area

When you are finished looking at or dealing with the information in the Status Center, you should press the OK button and you'll exit the dialog. On the other hand, if you want to leave the dialog but aren't done with the information in it, you can press the Close button. (This is the same as clicking on the close icon in the upper right corner or double-clicking on the system menu icon in the upper left corner.) Using Close rather than OK leaves the yellow color as a reminder to look again at the Status Center.

Junk Spy Keeps Up-to-Date

One of Junk Spy's important features is its ability to automatically receive and process junk detection updates via email. While you can disable this feature in the Update Settings if you prefer, it is the way Junk Spy stays up-to-date working for you to eliminate junk mail.

This service of automatic updates is available only to licensed users of Junk Spy, and is initially based on the contact information provided when the product was purchased. Updates will be sent periodically to keep Junk Spy's database of detectors current.

As part of the update service, licensed users also have access to the Junk Spy Detection Update Center. Information about it - and a password for it - is emailed shortly after purchase.

We strongly suggest that you change the password right away to something that is meaningful to you.

The Detection Update Center is the place to go if you need to change the email address that your Junk Spy updates are sent to. In addition, you'll see your personal update history and can have any updates you might have missed resent immediately, if necessary.

The Junk Spy Monitor

You might want to periodically look at the email Monitor. It shows you what Junk Spy's done for you. It gives you the same information as the report indicators on the left in Junk Spy's message area, but here they are all displayed together at the same time. In addition, the Monitor gives some specifics on your most recent message and your most recent junk message - which might be the same if the most recent message is junk mail.

Like the Status Center, the Monitor is a menu option. Right-click on the message area to bring up the popup menu and select Monitor; or, you can access the option by clicking on the system menu icon in the upper left corner, selecting Junk Spy, and then Monitor.

As a shortcut, you can double-click on the message area to display the Monitor. Conversely, double-clicking on the message when the Monitor is open will cause it to close.

4. Technical and Other Support from Sundial Systems

• Send email to JunkSpy@sundialsystems.com
• Send postal mail to Sundial Systems, 909 Electric Avenue, Suite 204, Seal Beach, CA 90740 USA
• Visit the Sundial Systems web site at http://www.sundialsystems.com
• Phone 562-596-5121 (9:00 to 4:30, Monday through Friday, Pacific time)
• FAX to 562-596-7825

In an ideal world, Junk Spy would catch every piece of junk mail that's sent to you, and that, indeed, is the goal. Toward that end, you can help by forwarding a message that should have been recognized as junk (but wasn't) to: junk@sundialsystems.com.

The message will then automatically be entered into Sundial's database of suspicious email.

When a Message Gets Identified as Junk by Mistake:

Conversely, a message might be classified as junk when it shouldn't have been. In order to correct such misidentification, Sundial Systems wants to know when that happens. You can help by forwarding the message that was incorrectly identified as junk to: nojunk@sundialsystems.com. This will help with Sundial's on-going analysis of what is and is not junk mail.

In addition, depending on the particular message and who it is from, you might want to create an exception to prevent this from happening again. Thus, this might be the right time to make use of Junk Spy's Exception Wizard. Its purpose is to help you create effective exceptions to Junk Spy's analysis so that you don't miss messages that you really want to get.

5. Junk Spy's Menu Options

• Detectors - what Junk Spy uses in its junk mail detection process
• Global Exceptions - used to override Junk Spy's detectors
• Status Center - gives you information relevant to you and your installation of Junk Spy
• Monitor - lets you watch detailed information as messages are filtered
• Exception Wizard - helps you quickly create an exception to Junk Spy's detectors
• View Log:
  • Detection Log - shows you what junk mail Junk Spy has found
  • Update Log - shows you when updates were made to the detectors that Junk Spy uses
  • Error Log - shows you operational errors that have occurred
• Settings:
  • Detector Settings - specify how Junk Spy should react to junk mail
  • Update Settings - specify how Junk Spy should handle automatic updates
  • Post Office Settings - controls connections for retrieving and sending email
• Help:
  • Help Index
  • General Help
  • Using Help
  • User's Guide - this on-line reference
  • Web Site - which will open your web browser directly to:
    • Junk Spy Home Page
    • Check for Upgrades
    • Junk Spy Detection Update Center
  • Junk Email Slipped Through - what to do when Junk Spy doesn't catch all your junk mail
  • Real Email Was Junked - what to do when a message is misidentified as junk
  • About Junk Spy - product information about your installation of Junk Spy

Note: There is on-line help in Junk Spy for all the menu options, dialogs, fields, and buttons. You can get help at any time by pressing the F1 key or clicking the Help button in a dialog.

6. All About Clues and Detectors

However, everything that Junk Spy uses is actually under your control. So if you want to make changes to the clues Junk Spy works with, you can.

Clues to Junk

Clues are what Junk Spy uses as it analyzes your mail for junk messages, and there is no restriction on how many clues you can have.

Each clue has its own definition which is composed of several elements:

• Specific text
• Optionally, an exclusion to the text
• Where the text is in a message

The Find field has the specific text of the clue. In the example pictured, the text is "HOME BASED". If there is an exception that should prevent Junk Spy from making a match with this text, it goes in the Unless field.

At first glance you might think that you want to put something quite specific into the Unless field. Maybe you have a brother who forwards all the "home based" type offers he gets to you so you can advise him about them. In that case, you'd be inclined to use your brother's email address as the exclusion with HOME BASED. But, this works only for this one clue. It actually is more appropriate to put your brother's address on the Global Exceptions  list, so that nothing he sends you is treated as junk.

Rather, the Unless field in clue definitions is better used for exceptions you don't have specifics on. For example, you might want to put "Internet" in the Unless field with the HOME BASED clue because you want to see all the emails relating to home based Internet-related business opportunities.

In addition to specific text, the definition of a clue includes the part of message that Junk Spy will Search in for the text:

• To - the email address the message came to
• From - the email address the message came from
• Subject - the subject line of the message
• Header - everything above the body of the message, including the to, from, and subject information
• Body - the text of the message
• Entire message - all of the above

You might be saying, "Well this is all well and good, but where are the definitions for clues?" They aren't listed on the Junk Spy menu. That's because there are lots and lots of clues which are grouped together for convenience into Detectors (which are on the menu).

Looking at Detectors

• The detector Name which you can change if you prefer something else,
• An Enabled checkbox which controls whether or not Junk Spy uses this detector's clues in identifying junk mail, and
• A list of clues which can be individually managed by:
  • Adding new clues,
  • Modifying clues already defined, and/or
  • Deleting clues from the list.

Note: You don't have to delete a detector to not have it used. Instead, you can uncheck the Enabled option that is part of the detector's definition.

Global Exceptions Are Never Junk

You can use the Add, Modify, and Delete buttons to maintain your list of global exceptions. Adding or modifying a global exception is just like adding or changing a clue in a detector. You specify the exact text to be searched for, a possible exception to it, and where the text should be looked for in messages.

For example, one of the common uses of junk mail is to advertise multilevel marketing schemes, commonly called MLM. Thus, there is a clue specifically for MLM. Maybe you hate MLMs, but you're a member of the Modern Lawn Mowers' Assocation which goes by the name MLMA. Normally your MLMA mail would be considered junk because it contains MLM. However, if you create a Global Exception for MLMA, any mail containing MLMA will not be considered junk no matter which clues it matches.

Sometimes it's not quite so straight forward. If you'd like some help creating an exception, turn to Junk Spy's Exception Wizard. It starts with an email message that you don't want classified as junk, and with your answers to a few questions ends up with the exception.

The Exception Wizard

When you always want to be sure of getting certain mail, the best thing to do is to create an exception. You have a choice - the exception can be tied to a particular clue or it can be global. It's not always easy to decide what kind of exception you need, and that's where the Exception Wizard comes in.

You'll find it as an option on the Junk Spy menu which you get to by right-clicking on the message area, or by clicking on the system menu icon in the upper left corner and then selecting Junk Spy. The Exception Wizard works with a message that you don't want to be considered junk mail, but which Junk Spy has identified as such. It asks you questions that help it suggest an appropriate exception, and then creates the exception for you if you approve.

The process is really quite simple and direct. When Junk Spy has misidentified a piece of email as junk, here's what you can do.

1. Start the Exception Wizard by selecting it off the Junk Spy menu.
2. Copy the entire message - including the header information - to the clipboard. If you are unsure how to do this, the Exception Wizard help will give you instructions for a number of email programs.
3. Answer the questions the Wizard poses.
4. Approve the proposed exception to complete the process.

As you might expect, not all messages can be effectively analyzed. Sometimes it's simply that what makes sense in most cases, doesn't make sense for you this time. Other times, it's that the header information for the message is incomplete. Some email programs - such as Notes - include only partial or no header information when the complete message is copied.

Headers are, in fact, rather complicated looking, which is probably why your email program generally hides them from you. Below you can see what the header information from an actual email message looks like. Look toward the bottom, and you'll notice that Junk Spy flagged this one because it matched a clue in the Get Rich detector.

7. Settings for Detectors, Updates, and Connections

• Detector controls the general processing behavior.
• Update controls the use of updates to Junk Spy's detectors sent by Sundial Systems.
• Post Office controls the connections for retrieving and sending email.

Several things can happen to junk mail. First, there's what Action to take when a message matches a dectector. You can either have the message destroyed or have it flagged as junk and delivered to you. Which you choose may be determined by the email program you are using because some programs require one or the other. You might want to check the setup instructions for using Junk Spy that are specific to your email program.

There are additional Options you can utilize regarding junk messages, and you should check those you want:

Forward a copy to the Junk Spy Research Center -

A copy of each junk message will be sent to Sundial for analysis. This is useful because it gives Sundial a larger database of junk mail to work with. The more messages that are analyzed, the more accurate the clues and detectors can be to thoroughly screen your mail. All messages forwarded to the Junk Spy Research Center are held in the strictest of confidence, and those that don't meet Sundial's definition of junk mail are immediately deleted.

Send with warning to -

Messages identified as junk are forwarded to another email addres, so be sure to enter the forwarding address in the field provided. As a precaution, a warning that the content is junk mail is included with each forwarded message.

Save to file -

Messages that match clues are saved to the indicated file you specify in the field provided. If you don't include a path with the file name, the file will be saved in the directory where you have Junk Spy installed.

Record in log -

Junk Spy will maintain a log file of the junk mail messages it finds. You can look at the log by selecting the View log - Detection option off the menu.

There are Compatibility issues with your email program to consider.

Mark subject field -

Junk messages are so designated at the beginning of the subject which provides a good visual indicator. Beyond that, some email programs do require it for filtering.

Bypass detector for messages larger than... -

Junk mail messages are generally not large. If you frequently receive large messages, or messages with large attachments, this is a useful option. Messages larger than the number of kilobytes you specify will not be looked at, which can save analysis time.

In addition to Junk Spy's built-in detection system, External Detectors give you the option to also make use of several on-line services provided by independent organizations for combatting junk email. The Enable option for External Detectors must be checked in order for Junk Spy to utilize any of them. Each service can be utilized or not, as you'll see when you look at the Settings for external detectors.

Two of the outside anti-junk email resources - the Relay Spam Stopper (RSS) and Realtime Blackhole List (RBL) - are services of the Mail Abuse Prevention System (MAPS). MAPS is a nonprofit company whose self-proclaimed goal is "to stop the Internet's e-mail system from being abused by spammers." Information about them can be found at http://maps.vix.com.

The Realtime Blackhole List and the Relay Spam Stopper list include networks which are known to be friendly, or at least neutral, to spammers who use these networks either to originate or relay junk mail. The two lists are similar, and to some extent overlapping, but use different criteria to determine which networks and servers are contained in the list.

ORBS (Open Relay Behaviour-modification System) is an anti-spam project maintained by volunteers. They are on the web at http\\www.orbs.org.

ORBS differs from RBL and RSS in that its main focus is on voluntary prevention and correction of web servers that permit third-party relays, a common method used to distribute junk mail. ORBS contacts sites with offending web servers directly, and many of them correct the situation right away. Those that don't are placed in the ORBS database of confirmed problem - i.e., open - web servers.

When ORBS, RBL or RSS support is enabled in Junk Spy, all of the servers that a piece of mail has passed through are checked against those on the corresponding list. If even one of the servers is found on the list, the message is considered junk mail.

To make use of a screening facility, check the Enable box. An IP address or host name for its server is indicated in the Server field. If the address changes or you prefer using a different one, you can change the IP address or host name in this field.

Update Settings

Log updates -

A record is logged each time an update is made to Junk Spy. You can look at this log at any time by selecting the Update option on the View Log submenu.

Send acknowledgement -

Sundial Systems is sent a notification that your installation of Junk Spy has received an update. This helps Sundial keep your copy of Junk Spy up-to-date.

Permit reports -

As part of the updating process, Junk Spy may be asked for feedback information to help Sundial Systems with its on-going analysis of junk mail. This authorizes the requested information to be sent to Sundial.

Post Office Settings

The Post Office Settings control your connections for receiving and sending email. In general, you should only need to make changes to these settings when you are configuring your email program and Junk Spy to work together.

You may need to specify addresses for your inbound and/or outbound mail Servers.

Default POP3 mail server -

This is your inbound mail server. Junk Spy needs to know this information in order to work with some email programs, so the field may - or may not - need to be filled in. The Getting Started documentation for your specific email program will tell you if this is necessary.

SMTP server -

This field is used to specify an alternate outgoing mail server if your POP server does not support sending. The information is necessary for some Internet Service Providers (ISPs). If you traditionally have to set SMTP server information in your email program for it to send mail, then you should provide that same information here for Junk Spy as well.

For Connection Security between Junk Spy, your email program, and the outside world, you have two options. Both reject connection attempts from outside your own system.

• The Most restrictive post office connection prevents anything other than your local email program from connecting to Junk Spy. It is the most secure from misuse by other programs and other computers.

• The Restrictive connection is slightly less secure. However, your email program and TCP/IP configuration may make it necessary. Connection attempts will be prevented, but if you want to know when they occur, check the Receive warnings option.

If you connect to the Internet over a dial-up line, you will probably want Junk Spy to Monitor (the) Dial-up Connection. Check Enable to have Junk Spy monitor your connection and only attempt to process mail when the dial-up connection is active. You'll also want to specify in the Interval field how frequently the connection status should be checked. Every 30 seconds is a reasonable frequency, but you can make it shorter or longer.

Note: This only applies to dial-up connections. If you use another method for email, don't enable the Monitor Dial-up Connection option. Also, this setting does not determine when Junk Spy tries to receive mail. It only determines how often if checks to see if your dialup connection has been established.

If the standard POP3 port (110) is already in use by another application, Junk Spy will need to use another port for your Local Connection. Check Enable if an alternate port should be used and put its number in the Listen port field.

8. Looking at Junk Spy's Logs

The Detection Log -

No matter how you have Junk Spy handle your junk email, all the junk messages Junk Spy identifies can be recorded in the Detection Log. Whether or not junk mail is logged is one of the Detector Settings options. When logging is selected, you'll get information for each junk message that shows you:

• The time and date the message was received,
• The detector and specific clue that were found in the message,
• Who the message was addressed to,
• Who the message came from, and
• The subject line of the message.

If you notice an entry in the Detection Log for a message that should not have been classified as junk, there are a couple things you can do.

• For instance, you might want to make an exception to the clue that caused the message to be identified as junk. First click within the log area anywhere in the entry you are concerned about; then press the Clue button for the clue's definition.

• Or, you might want to create a global exception that is broader because it isn't associated with just one clue.

• If you aren't sure what kind of exception you want - or even if you want one - and if the message noted in the log is still available to you (perhaps in a special folder of your email program, or a file), consider using the Exception Wizard to help you figure it out.

• Also when a message is identified incorrectly as junk, please let Sundial know about it. Forwarding the misidentified message (if you have it in a trash folder or file) is most useful. In lieu of that, copy the information about the message from the log and mail that information.

Note: Sundial Systems also wants to know about junk that doesn't get caught. By forwarding such email to Sundial, you'll be helping improve the junk mail database used to extrapolate Junk Spy's clues.

The Update Log -

Updates to Junk Spy's detectors are the way the product stays up-to-date. This log shows when updates were made.

Whether or not Junk Spy automatically processes updates, and if they are logged, is controlled by the Update Settings.

The Error Log -

Errors can happen for a number of reasons. This log gives you the time, date, and a brief description of all the errors that Junk Spy encounters.

9. Junk Spy Product Information