Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Daron — Mon, 18 Jul 2005 23:07:02 GMT

What is the "out of the box" mode setting for SenderID filtering?

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Nikolayev — Mon, 18 Jul 2005 23:29:17 GMT

The default setting is "Accept".

Anti-Spam Framework in Exchange 2003 SP2

Tim Mintner's Blog — Tue, 19 Jul 2005 01:40:29 GMT

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Shannon — Tue, 19 Jul 2005 02:07:14 GMT

Will messages that IMF deem as spam be rejected at the SMTP level; or will it accept the mail and then send a new bounce message to the "sender"? (Or is it an admin configurable option? - I hope that reject is used over accept-than-bounce.)

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Nikolayev — Tue, 19 Jul 2005 02:43:02 GMT

Shannon, there are no changes in the way IMF functions and the mail needs to be accepted first. Yes, this is "accept-then-bounce", however, with IMF running in REJECT mode you can implement CustomRejectResponse functionality that will help with False Positives investigations.

Exchange 2003 SP2 Anti-SPAM framework

ExchangeIS — Tue, 19 Jul 2005 05:07:01 GMT

A detailed post on the new Anti-SPAM framwork being shipped with Exchange 2003 SP2 from the Exchange...

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Fabio — Tue, 19 Jul 2005 12:07:17 GMT

Will IMF be support in a cluster enviroment?

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Zammit — Tue, 19 Jul 2005 12:14:32 GMT

Phishing Confidence Level - Clearly we will need an update of the Exchange SDK with more details on this. Any news on when it will be available?

Also any hints on when SP2 will be available as beta?

Exchange, SQL, Security, Live Meeting, LCS, SMS, Misc.

Windows Server Clustering — Tue, 19 Jul 2005 18:30:04 GMT

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Nikolayev — Tue, 19 Jul 2005 21:20:21 GMT

Fabio, IMF will not be supported on clusters in E2K3 SP2.
Alexander, SP2 should be available as beta in the nearest future. We are starting the pilot program for SP2 IMF updates with TAP participants in August.

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Holger — Thu, 21 Jul 2005 13:50:31 GMT

What is the reason that IMF is not available for clusters? There are a lot of single cluster installations that would benefit from IMF.

Great article on SP2 spam filtering

Exchange Security — Thu, 21 Jul 2005 18:39:08 GMT

<p>
Get the details on how Sender ID/SPF filtering work in Exchange 2003 Service Pack 2.
</p>

Exchange, SQL, Security, Live Meeting, LCS, SMS, Misc.

Windows Server Clustering — Fri, 22 Jul 2005 04:31:33 GMT

Weekend reading

subject: exchange — Fri, 22 Jul 2005 13:43:36 GMT

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Dan Sheehan — Sat, 23 Jul 2005 15:51:19 GMT

Can you all please add the action of "re-direct" as an IMF action? We have a Brightmail quarantine database that we want to leverage, and it would be awesome to re-direct IMF positives to the same location.
The reason I ask is because our help desk has direct access to the quarantine, and they don't bug the engineers. With the IMF "Archive" function, we either have to give them direct action to all of our SMTP connector servers to search for "missing email", or take on that responsibility ourselves.
The technology is great, we just need it to be a little more process friendly before we can implement it. If you all do add this feature, we will use IMF in conjunction to Brightmail to provide layers in depth - which is always a security best practice.

Thanks!!!!

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Nikolayev — Fri, 29 Jul 2005 03:33:25 GMT

In response to Holger's question:
The best practice is not to run the Intelligent Message Filter in Exchange server cluster environment. However, it can run on front-end servers that are in a NLB cluster. The reason we do not support IMF in Exchange cluster is that we recommend IMF to be deployed as close to the perimeter as possible, and clusters usually get positioned far behind the edge and generally do not serve for anti spam processing.

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Kevin Laahs — Fri, 29 Jul 2005 16:12:06 GMT

Great article! At which point in the process is Sender ID filtering done?

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Nikolayev — Fri, 29 Jul 2005 23:35:50 GMT

In response to Kevin Laahs:
Kevin, Sender ID filtering happens right after EndOfData (EOD) and before the content filtering (IMF).
In response to Dan Sheehan:
Dan, I need a little more time to answer your request.

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

David — Sat, 30 Jul 2005 22:01:27 GMT

Good stuff, thanks!
How to customize "server response string" for IMF?

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Nikolayev — Thu, 04 Aug 2005 19:46:59 GMT

"Server Response String":
You need to set CustomRejectResponse string regkey under HKLM\Software\Microsoft\Exchange\ContentFilter. If the value is present it will be used in 550 5.7.1 instead of default.

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Nexus — Sat, 06 Aug 2005 23:17:59 GMT

I was wondering what the testing on effects of installing SP2 with a server that already has IMF installed.

Any tricks or gotchas? Do you have to remove the standalone IMF install before installing SP2?

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Nexus — Sat, 06 Aug 2005 23:19:24 GMT

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Exchange — Mon, 08 Aug 2005 18:34:54 GMT

Nexus,

SP2 installation will prompt an error if IMF v1 is installed on the server and IMF v1 has to be removed before SP2 is installed.

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Nexus — Tue, 09 Aug 2005 07:27:52 GMT

Thanks for the answer, Ill spread the news. looking forward for SP2's release.

Sorry about the double post, the blog didnt seem to refresh.

Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

You Had Me At EHLO... — Wed, 24 Aug 2005 19:55:39 GMT

By this time, you all must be already aware of new anti-spam features provided in Exchange Server 2003...

Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Joachim Farla Blog — Wed, 24 Aug 2005 20:49:30 GMT

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Mik — Fri, 26 Aug 2005 01:59:13 GMT

I found this very interesting. I was wondering about what your team thinks about two possible features that I did not see covered, which IMHO would help to further minimize false negatives, false positives, and administration load:

- Custom Message Weight: will it also support a simple list of "Bad Attachment Types"? E.g. any message with .exe, .scr, etc. could be deleted, archived or otherwise processed within the Exchange Server environment.

- Turing test mailback and response processing: I think this is vital, I mean, to give real and honest users a chance, rather than making them collateral victims of the sum of all the technology we increasingly use against spam. And for doing all of this without requiring the admin to take action.

Also, what about integration with client-side whitelists? E.g., can the end user force-enable some senders in Outlook 2003 (Safe Senders, Safe Recipients), and make sure these get through even if Exchange Server might otherwise mark them as UCE? Again, the idea is to empower the user and make the system more responsive to urgent needs, and at the same time reduce the load on the admin.

Thanks for listening.

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Nawar — Sat, 03 Sep 2005 02:50:51 GMT

So when SP2 applied in a cluster IMF wont be installed by default, right ?

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Harald Bardenhagen haraldba@microsoft.com — Sat, 03 Sep 2005 10:27:53 GMT

Great article - very good stuff!
I did set the CustomRejectResponse key on the SP2 Frontend Server as described, restartet machine - but still see the default response? Anything else to be enabled here?

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Nikolayev — Sat, 24 Sep 2005 23:50:38 GMT

Harald, in order to take an advantage of this feature, IMF should be configured in 'Reject' mode.

re: Exchange 2003 Server Service Pack 2 (SP2) Anti-Spam Framework

Alexander Nikolayev — Sat, 24 Sep 2005 23:55:36 GMT

To answer a question from Nawar - IMF will be installed but not enabled by default. IMF is not supported on Exchange clusters, however, you can run IMF on NLB clusters.