Life of an IT Pro Advisor @ Microsoft Canada

I would like to use it, but it is not supported on a clustered environment and I don't have a FE server. The rules seem to work OK when I use them on Outlook Junk Mail filtering, so I believe that they would work with IMF too.

Yes I have deployed it at many customers. Main complaint is that the IMF updates are not in sync with the ol2003 updates. Also whitelisting support would be a huge benefit.

Please respond and tell me your are working on this :-)

Hey Rick,

I had deployed IMF prior to the tour and I can attest that it has helped with the aamount of SPAM in our environment. I've used the built-in perfmon counters it adds to verify a 30% reduction in total mail into our environment. My settings are 8 at the gateway and until recently 6 for the store.
I recently reduced the store setting down to 5 as I've verified from my userbase that there were no false positives with my previous settings and perfmon showed a lot of mail still coming in marked as 5. I used some articles posted on the Exchange team blog to expose the SCL in Outlook http://blogs.technet.com/exchange/archive/2004/05/26/142607.aspx and confidently reduced it down to 5 for an additonal 5% reduction.
Folks, this is a free add-on for Exchange and the ROI is fantastic for companies that can't afford the commercial anti-spam tools.
I do find that sometimes messages that are marked as 5 still show up in my Inbox so there seems to be some bugs to iron out, but overall I'm quite happy with it.
I can't wait until SP2 for Exchange 2003 as I hear some of the bits previously intended for "Edge Services" are now going to make it into the product at no charge. This should include the Sender ID technology which I hope will further work towards the goal of erradicating SPAM from our Inboxes.

Rick Claus asks in his weblog about the experiences with Microsoft’s spam filter for Exchange 2003. We have been using the IMF since its availability in June 2004. Messages with an SCL greater than or equal to 4 are moved to the user’s Junk...

My main beef with IMF is that any messages not considered spam and not directed to a valid user would cause an NDR to be sent back to what is frequently an invalid email address or SMTP server. What I found was that the SMTP queue frequently contained 80+ retries and it just seemed to keep climbing.

Often, the spam we see in our office is what some people refer to as directory harvesting. Basically if you send a legitimate-looking message to 10 users @domain.com, you will get an NDR for each user that does not exist. However, if one of those users exists -- voila, the spammer knows it because there is no NDR for it. This is obviously what is clogging up the SMTP queue as well.

I am no longer using it for this very reason and am evaluating another tool. However, I have determined that the RBL filter in this tool is what is catching 80% of the spam. Since IMF also implements RBL lists, I guess I may have gotten better results with IMF if I had also filtered from RBL lists. I am aware of the issues with RBLs but given the amount of spam that gets past IMF, something needs to give.

One obvious suggestion would be to turn off NDRs in Exchange. I considered this but what if someone sends a legit message but misspells the email address? No one will know about it. I consider this to be a greater evil than the RBL so I am keeping the NDR but using the RBL.

One suggestion I have that I really like in the product I'm evaluating is the ability to whitelist the email address of every outgoing message. This seems like a really good way to build up a whitelist. Are you listening, IMF developers?

There's a blogcast demo of the IMF here:
http://blogs.technet.com/eileen_brown/archive/2005/02/15/372969.aspx