Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Scott — Wed, 24 Aug 2005 21:15:25 GMT

Where would a third party spam filtering solution (i.e. Brightmail) fit into this? If you've installed a third party solution on the Exchange server, are all messages scanned by both spam filters, or does one of them somehow take precedence?

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Tonino Bruno — Wed, 24 Aug 2005 22:40:29 GMT

I believe brightmail links up to the PRECAT queue while IMF links up to the POSTCAT queue..

So brightmail would scan the message first..

Sincerely,
Tonino Bruno

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Konstantin Ryvkin — Wed, 24 Aug 2005 23:01:44 GMT

IMF is a *protocol* event sink. As pictured above it hooks up to the _End_of_Data command. (CRLF.CRLF). After the messages passes the above stages they are submitted to the Exchange's advance queuing system.
Brightmail is a *transport* event sink, which is inside advance queuing.
So if installed on the same server IMF (along with the above filtering methods) will be engaged prior to Brightmail for messages comming through SMTP.

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Scott — Thu, 25 Aug 2005 21:46:13 GMT

When we first added the IMF, we set it to "No Action" because we wanted to just watch the performance monitor counters to see how it was doing. Once we did that, though, we got absolutely killed with spam. When we then enabled the IMF blocking, the spam dropped down to a more reasonable level. That led us to believe that the IMF was somehow interfering Brightmail because there was a drastic increase of missed spam with IMF (no action) + Brightmail that we had with Brightmail alone.

Is there any case where the IMF will effectively bypass a third party spam filter?

Since we've had the IMF and Brightmail enabled, many of our users swear that they're getting more spam than they did before when it was just Brightmail. It would be nice to be able to reassure them that both filters work nicely with each other, but so far I haven't been able to get a definitive answer on that.

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Twan Grotenhuis — Fri, 26 Aug 2005 21:48:17 GMT

Why is sender-id hooked up to the End_of_Data command?
For as far as i know everything you need for sender-id (apart from looking up the DNS record) is already provided by the sender.

It's something i've been wondering ever since techEd Amsterdam.

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Jeffrey Rosen — Mon, 29 Aug 2005 00:22:03 GMT

Because SenderID is based on the RFC2822 Mail From.
(Which it will not have until the End of Data)
;-)

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Jeffrey Rosen — Mon, 29 Aug 2005 04:48:51 GMT

I stand corrected (and detail is important)

Sender_ID is based on PRA which is determined from RFC2822 headers (Resent-Sender, Resent-From Sender, From)

There is no “MAIL FROM” in RFC 2822, there is FROM, which the outlook user sees.

Thanks Konstantin for the answer!

Exchange, Windows, SPS, LCS, Live Meeting, Security, MIIS, Misc.

Windows Server Clustering — Wed, 14 Sep 2005 03:55:49 GMT

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Tom — Mon, 19 Sep 2005 21:17:34 GMT

We have our own edge services running just fine, as it seems MS is about 2 years behind the curve in their "innovations". My question is, given that we have a successful exchange implementation by not exposing it to the edge at all, will all the default SP settings be a transparent install?

re: Exchange Server 2003 Service Pack 2 (SP2) anti-spam features - order of execution

Alex Nikolayev — Mon, 19 Sep 2005 22:40:05 GMT

Tom, Exchange 2003 SP2 upgrade will not make any changes to the implementation you have in place (you will need to uninstall the IMFv1 if you have it installed on the upgrading server). In order to take advantage of the new features you must manually enable them, out of the box they are not enabled.