Description

This article provides information on how to test if SRX/J-series devices are correctly detecting spam.

Symptoms

  • Anti-spam in SRX branch and J-series devices uses SBL to detect e-mails from known SPAM sources.
  • The  test security utm anti-spam profile <profile-name> test-string x.x.x.x command can be used to test if e-mails from a specific IP address will be detected as spam.

Solution

The following command can be used to test if e-mails from a specific IP address will be detected as spam by Junos:

test security utm anti-spam profile <profile-name> test-string x.x.x.x
Sample output:
SRX> test security utm anti-spam profile as-profile test-string 10.1.1.1

Anti-spam test result:

Return SPAM, action Deny, reason Match sbl server blacklist
Currently, the Juniper anti-spam solution uses the Sophos SBL list. For information on how to check if an IP address is in the Sophos anti-spam database, refer to  KB15230 - How to Check if an IP Address is in the Anti-Spam Database [juniper.net] . 
 
Note: The ' test security utm anti-spam ' command has been deprecated starting in Junos 15.1X49-D10. While the command executes without any problem, the result will be 'error: Anti-Spam test is disabled now'. The best way to verify Antispam functionality would be by monitoring ' show security utm anti-spam statistics '.

Modification History

2019/03/11: Added note regarding the deprecation of the 'test security utm anti-spam' command