The Message Score Normalization is a LibraCyber Email Security exclusive feature you can enable in the Anti-Spam Settings page.
Note: no additional license is required.
Its goal
The goal of the Message Score Normalization algorithm is to minimize false positives or false negatives. It averages out the “score spikes” between different emails. By the very nature of averages, this means that it will push the high points down, and the low points up, but it will always push them towards the average for that sender. As long as the average for that sender is on the right side of the spam/non-spam fence, it will do its job nicely.
How does it work
The algorithm works using a local database of entries. Each entry has a key formed by the identifier, and optionally the IP address it originated at, and the DKIM signature. It contains a TOTAL score of messages and a COUNT of messages. The MEAN score is TOTAL/COUNT. Each sender is identified by several IDs: the From email address in combination with the originating IP block (or DKIM signature, or SPF pass, if available), the standalone From email address (without any IP), the domain name of the From address, the full IP address, and the HELO name of the originating client. Each of these ID types has a configurable weight factor when calculating the overall sender's reputation.