Google Message Security for Google Apps Administration Guide - Manual (Page 406)

406 Message Security for Google Apps Administration Guide
X-pstn-2strike Header Field
An exception to the spam score and threshold calculations is the X-pstn-2strike
header field. The X-pstn-2strike field indicates that the spam score was below
the effective threshold, but was likely a valid message. This is based on the IP
address of the sender and other message characteristics. If the spam score (S:) is
greater than 0.15, the message was allowed through as a valid message.
Example:
X-pstn-levels: (S: 0.22604/99.8045 R:97.45080 P:76.42022 M:64.93900
C:93.23770 )
X-pstn-settings: 5 (2.00000:1500.00000) r P M c
X-pstn-2strike: clear
In this example, the X-pstn-2strike is set to “clear” so the message was delivered.
X-pstn-xfilter Header Field
The x-pstn-xfilter header field indicates that the message triggered a global
pattern rule. The message service maintains a minimal number of these rules to
ensure that certain messages are quarantined as spam, regardless of the spam
score.
One example of a global pattern rule is the presence of “ADV:” in the message
subject line. The United States CAN-SPAM act mandates that any message with
ADV: in the subject line should be considered an advertisement; even if the
message doesn't score as spam, this global rule ensures that the message is
quarantined. Global pattern rules may occasionally be used as a method to
respond quickly to new types of spam.
Example:
X-pstn-xfilter: yes
In this example, the X-pstn-xfilter is set to “yes” so the message was processed as
junk mail.
X-pstn-neptune Header Fields
This header field indicates that although the message did not score as spam, it
was likely a junk message based on the sending system's behavior, and therefore
quarantined:
X-pstn-neptune-rslt: qtine
The header field “X-pstn-neptune” contains only internal scoring information, and
looks similar to this:
X-pstn-neptune: 287/236/0.8223004.2/59
Occasionally, you may see this header field, which is also used for internal
monitoring: