Exchange Server Pro » Anti-Spam

Understanding the Exchange Server Spam Confidence Level

Paul Cunningham — Wed, 23 Jun 2010 14:05:47 +0000

If you have looked at Exchange Server’s anti-spam features or taken a peek at the headers of an email sent through an Exchange server you have probably encountered the term SCL before.

SCL stands for Spam Confidence Level. It is the “score” that Exchange Server anti-spam assigns to an email based on the email’s contents. This score is then used to make decisions as to how to handle suspected spam based on the thresholds that the Exchange administrator configures.

Having a detailed understanding of the SCL and how it is used in Exchange Server anti-spam will allow an email administrator to get good performance from their anti-spam deployment.

Review of GFI MailEssentials

Paul Cunningham — Tue, 12 Jan 2010 12:22:20 +0000

GFI MailEssentials is an anti-spam and email management product from GFI Software.

MailEssentials boasts 99% accuracy for spam detection thanks to its two anti-spam engines, and at the same time a very low rate of false positives thanks to Bayesian filtering. The software also includes several useful email management features such as disclaimers, auto-responders, and archiving.

Installing GFI MailEssentials

The latest version 14.1 of MailEssentials is compatible with both Exchange Server 2007 and 2010, or can be installed on a standalone SMTP server.

When installing on an Exchange server most of the pre-requisites will aready have been met, but you may find you need to install the MAPI Client and Collaboration Data Objects available from Microsoft’s download site as well. The installer can also automatically install the MSMQ pre-requisite if you haven’t already installed it.

The installation is then a breeze with the only significant choice being whether to enable Active Directory integration or to install MailEssentials as a DMZ server with no AD access.

After the installation is finished an intial configuration wizard is launched. Here you can specify the SMTP domains to protect with MailEssentials.

The Exchange Server roles are automatically detected and that determines which of the MailEssentials components get installed.

The initial configuration wizard only takes a moment to finish, and GFI MailEssentials is now set up and ready for use.

Key Features of GFI MailEssentials

Anti-Spam Protection

The default configuration of MailEssentials provides immediate spam detection using the SpamRazer engine, phishing protection, and prevention of directory harvest attacks. The server is also configured with DNS RBL services and default sender and keyword filtering policies to block well known spam patterns.

Bayesian training is automatically enabled and monitors outgoing emails. This helps the Bayesian filter learn what sort of email content is likely to be legitimate for the organization. When this intelligence is combined with the frequent spam data updates from GFI it keeps false positives to an absolute minimum.

Administrative Features

Administrative burden is greatly reduced by offering end user self-service options via the Exchange Public Folders. Email users can help train the Bayesian filter using drag-and-drop to move email items between different Public Folders which then tells the server whether the item is spam or not.

In addition when spam is detected it can be delivered to folders within the user mailbox or the Public Folder store, giving users access to the quarantine to review their own spam.

Reporting and Monitoring

GFI MailEssentials includes a real-time monitoring dashboard as well as an easy to use reporting interface so that you can measure the performance of its anti-spam features.

Email Management Features

One of the best features MailEssentials provides for Exchange Server 2007 environments is email disclaimers that can be configured on a per-domain or per-user basis.

Exchange Server 2007 can do disclaimers using Transport Rules but these are limited to text only, whereas GFI MailEssentials permits HTML disclaimers and a set of variables that can be used to create much richer, more dynamic disclaimers.

The MailEssentials disclaimer feature also continues to work after the product trial period has ended, so it can be used as a free disclaimer add-on for any Exchange 2007 or 2010 environment.

GFI MailEssential is available as a full featured 30 day trial for download from GFI Software. MailEssentials is also available as a free email disclaimer tool for Exchange Server 2007 and 2010.

Get more Exchange Server tips at ExchangeServerPro.com

Evaluating Anti-Spam Software

Paul Cunningham — Wed, 27 May 2009 20:39:54 +0000

I used to do some work for a customer who’s idea of running an evaluation of a new system was to pick one product, put it in, then if it sort of worked good enough to just buy that one. Over the long term some of these choices turned out to be less than ideal.

Over at AllSpammedUp.com I’ve written a high level approach to evaluating anti-spam products for businesses.

If you are considering anti-spam solutions for your business it is important to take the time and evaluate possible solutions properly. Remember these basic steps:

Learn about which products are available on the market

Contact vendors to discuss your needs and access demonstrations and pre-sales support

Perform a testing phase before the evaluation phase

Utilise trial licenses of Windows, Exchange, and the anti-spam software, along with spare hardware or a VMWare environment to reduce the impact on production systems

Evaluate all features thoroughly and consistently across the different products

By performing a proper evaluation of anti-spam products you greatly increase the chances that you will implement the product that is the best fit for your organisation.

Read the full article here.

Get more Exchange Server tips at ExchangeServerPro.com

Backscatter Spam and Exchange Server 2007

Paul Cunningham — Wed, 29 Apr 2009 18:20:56 +0000

Over at AllSpammedUp.com I’ve written an article on protecting both yourself and others from backscatter spam. Backscatter spam is also known as NDR spam and is the result of address spoofing combined with spam addressed to invalid recipients. As an Exchange administrator you want to be sure you aren’t contributing to the problem with your own email server.

Read the full article.

Get more Exchange Server tips at ExchangeServerPro.com

Articles about Exchange Server and spam prevention

Paul Cunningham — Tue, 17 Feb 2009 20:00:26 +0000

I’ve written some more articles recently at AllSpammedUp.com. One of the interesting things about writing these articles is that is has forced me to take a deeper look at Exchange Server 2007 antispam features and consider their effectiveness. My view at the moment is that with the right attention and configuration Exchange Server 2007 can do a good job at preventing spam, but still falls short of most of the better third party products available.

Get more Exchange Server tips at ExchangeServerPro.com

Spam quarantine features in Exchange Server 2007

Paul Cunningham — Sat, 27 Dec 2008 11:04:30 +0000

With the right configuration and ongoing tuning the built in Exchange Server 2007 anti-spam features can be effective in many environments. One thing I’m not a fan of though is the quarantine feature. You can read more about it in my latest post to AllSpammedUp.com here.

Link: Managing spam quarantine for Exchange Server 2007

Get more Exchange Server tips at ExchangeServerPro.com

How to configure Exchange Server 2007 Connection Filtering with SpamHaus

Paul Cunningham — Sun, 14 Dec 2008 20:41:53 +0000

Over at AllSpammedUp.com I’ve written an article on the Exchange 2007 Connection Filter agent, and I walk through the steps to configure it to use SpamHaus as an IP Block list provider.

A correctly configured Connection Filter agent saves the Exchange administrator a lot of time by avoiding the need to manually maintain a large list of blocked and allowed IP addresses. The Connection Filter agent also reduces server load by rejecting likely spam before it has been transmitted to the Exchange server and without requiring resource-intensive content scanning of the email message.

Read the full article here.

Get more Exchange Server tips at ExchangeServerPro.com

Event ID 454 and 17003 – A corrupt Sender Reputation database causes Exchange Server 2007 Transport service to stop

Paul Cunningham — Thu, 28 Feb 2008 01:58:51 +0000

Exchange Server 2007 Edge Transport server and Hub Transport servers with the Exchange Anti-spam features installed may report event ID 454 and 17003 if the Sender Reputation database becomes corrupt.

The Sender Reputation feature of Exchange Server 2007 is described here:

Sender Reputation is anti-spam functionality that is enabled on computers that have the Microsoft Exchange Server 2007 Edge Transport server role installed to block messages according to many characteristics of the sender. Sender reputation relies on persisted data about the sender to determine what action, if any, to take on an inbound message.

If the Sender Reputation database becomes corrupt you may find the Microsoft Exchange Transport service has stopped and the Application Event Log contains the following sequence of events.

Event Type: Error
Event Source: ESE
Event Category: Logging/Recovery
Event ID: 454
Date: 28/02/2008
Time: 9:32:20 AM
User: N/A
Computer: SERVER
Description:
edgetransport (4568) Sender Reputation Database: Database recovery/restore failed with unexpected error -515.

Event Type: Error
Event Source: MSExchangeTransport
Event Category: Storage
Event ID: 17003
Date: 28/02/2008
Time: 9:32:20 AM
User: N/A
Computer: SERVER
Description:
Sender Reputation Database: An operation has encountered a fatal error. The database may be corrupted. The Microsoft Exchange Transport service is shutting down. Manual database recovery or repair may be required. Exception details: Microsoft.Exchange.Isam.IsamInvalidLogSequenceException: Timestamp in next log does not match expected (-515)
at Microsoft.Exchange.Isam.?A0x051b51e0.HandleError(Int32 err)
at Microsoft.Exchange.Isam.Interop.MJetInit(MJET_INSTANCE instance)
at Microsoft.Exchange.Transport.Storage.DataSource.InitInstance()

Event Type: Information
Event Source: MSExchangeTransport
Event Category: Components
Event ID: 7001
Date: 28/02/2008
Time: 9:32:20 AM
User: N/A
Computer: SERVER
Description:
The service will be stopped. Reason: A failure occurred in a transport database operation.

The Sender Reputation database is located in C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\SenderReputation (if you have installed Exchange to the default location). The database file is the pasettings.edb file, a JET database, and as such you can use ESEUtil.exe to attempt repair or recovery.

An integrity check is usually the first thing to run:

[PS] C:\>eseutil /g "C:\Program Files\Microsoft\
ExchangeServer\TransportRoles\data\
SenderReputation\pasettings.edb"   

Extensible Storage Engine Utilities for Microsoft(R)Exchange
Server Version 08.01
Copyright (C) Microsoft Corporation. All Rights Reserved.   

Initiating INTEGRITY mode...
        Database: C:\Program Files\Microsoft\Exchange
Server\TransportRoles\data\SenderReputation\
pasettings.edb
  Temp. Database: TEMPINTEG6436.EDB   

Checking database integrity.   

The database is not up-to-date. This operation may find
that this database is corrupt because data from the
logfiles has yet to be placed in the database.   

To ensure the database is up-to-date please use the
'Recovery' operation.

You can attempt a recovery of the database:

[PS] C:\Program Files\Microsoft\Exchange Server\
TransportRoles\data\SenderReputation>eseutil /r /a trn   

Extensible Storage Engine Utilities for Microsoft(R)Exchange
Server Version 08.01
Copyright (C) Microsoft Corporation. All Rights Reserved.   

Initiating RECOVERY mode...
    Logfile base name: trn
            Log files:
         System files:    

Performing soft recovery...
                      Restore Status (% complete)   

      0    10   20   30   40   50   60   70   80   90  100
      |----|----|----|----|----|----|----|----|----|----|   

Operation terminated with error -566 (JET_errDbTimeTooOld,
dbtime on page smaller than dbtimeBefore in record) after0.281
seconds.

If the recovery fails a repair can be attempted:

[PS] C:\Program Files\Microsoft\Exchange Server\
TransportRoles\data\
SenderReputation>eseutil /p pasettings.edb   

Extensible Storage Engine Utilities for Microsoft(R)Exchange
Server Version 08.01
Copyright (C) Microsoft Corporation. All Rights Reserved.   

Initiating REPAIR mode...
        Database: pasettings.edb
  Temp. Database: TEMPREPAIR1968.EDB   

Checking database integrity.   

The database is not up-to-date. This operation may find
that this database is corrupt because data from the
logfiles has yet to be placed in the database.   

To ensure the database is up-to-date please use the
'Recovery' operation.   

                     Scanning Status (% complete)   

      0    10   20   30   40   50   60   70   80   90  100
      |----|----|----|----|----|----|----|----|----|----|
      ...................................................   

Scanning the database.   

                     Scanning Status (% complete)   

      0    10   20   30   40   50   60   70   80   90  100
      |----|----|----|----|----|----|----|----|----|----|
      ...................................................   

Repairing damaged tables.   

                     Scanning Status (% complete)   

      0    10   20   30   40   50   60   70   80   90  100
      |----|----|----|----|----|----|----|----|----|----|   

Deleting unicode fixup table.
...................................................   

Repair completed. Database corruption has been repaired!   

Note:
  It is recommended that you immediately perform a full
backup of this database. If you restore a backup made
before the repair, the database will be rolled back to
the state it was in at the time of that backup.   

Operation completed successfully with 595 (JET_wrnDatabase
Repaired, Database corruption has been repaired) after
7.656 seconds.

Though this may report success, and further integrity checks show the database to be healthy, you may still find the Microsoft Exchange Transport service will not start. In these cases you can delete the files in C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\SenderReputation. When the Microsoft Exchange Transport service is next started it will build a new Sender Reputation database.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server 2007 SP1 disables Exchange Anti-spam updates

Paul Cunningham — Tue, 05 Feb 2008 21:13:50 +0000

Here is the anti-spam configuration on an Exchange Server 2007 RTM server:

[PS] C:>Get-AntispamUpdates   

UpdateMode                  : Automatic
LatestContentFilterVersion  : 3.3.4604.600
SpamSignatureUpdatesEnabled : True
LatestSpamSignatureVersion  : 3.3.4604.600
IPReputationUpdatesEnabled  : True
LatestIPReputationVersion   : 3.3.4604.001
MicrosoftUpdate             : NotConfigured

And here is the same Exchange Server 2007 server immediately after upgrading to Service Pack 1:

[PS] C:>Get-AntispamUpdates   

UpdateMode                  : Disabled
LatestContentFilterVersion  : 3.3.4604.600
SpamSignatureUpdatesEnabled : False
LatestSpamSignatureVersion  : 3.3.4604.600
IPReputationUpdatesEnabled  : False
LatestIPReputationVersion   : 3.3.4604.001
MicrosoftUpdate             : NotConfigured

The Service Pack 1 installation disabled the Anti-spam engine updates. This stung me on a production system that I upgraded shortly after the SP1 release. Eventually someone in the office mentioned the ever increasing volume of spam emails to me and I subsequently made this discovery.

Sadly the Release Notes do not seem to include this issue.

Get more Exchange Server tips at ExchangeServerPro.com

Checking currency of Exchange Server 2007 Anti-Spam signatures

Paul Cunningham — Sun, 09 Dec 2007 23:56:28 +0000

Last week I wrote a post on what is missing from Exchange Server 2007 Anti-Spam. A short time afterwards Evan Dodds wrote back to me with an answer to the issue.

One could write a simple script to check what updates are available on MU in certain categories, etc. Sample VB script code is available on MSDN.

Nothing in the product though…

The update service looks up for updates and reports errors in downloading, etc.

The sample VBS code he refers to is this one. Trimming it down to just the essential code for this task, I came up with this:

Set objSearcher = CreateObject("Microsoft.Update.Searcher") Set objResults = objSearcher.Search("Type='Software'") Set colUpdates = objResults.Updates For i = 0 to colUpdates.Count - 1 Set objCategories = colUpdates.Item(i).Categories For z = 0 to objCategories.Count - 1 If objCategories.Item(z).Name = "Exchange Server 2007 Anti-spam" Then Wscript.Echo "Title: " & colUpdates.Item(i).Title End If Next Next

When executed on an Exchange Server 2007 box it produces output like this.

[PS] C:\Admin\Scripts>.\updatescript.vbs Title: Microsoft Exchange Server 2007 Enterprise Anti-spam Filter Updates v3.3.6009.660 Title: Microsoft Exchange Server 2007 Enterprise Block List Updates v3.3.6009.047 Title: Microsoft Exchange Server 2007 Enterprise Anti-spam Signatures v3.3.6009.915

I can then run Get-Antispamupdates to compare the Microsoft Update data to what is currently installed on the server.

[PS] C:\Admin\Scripts>Get-AntispamUpdates UpdateMode : Automatic LatestContentFilterVersion : 3.3.6009.660 SpamSignatureUpdatesEnabled : True LatestSpamSignatureVersion : 3.3.6009.915 IPReputationUpdatesEnabled : True LatestIPReputationVersion : 3.3.6009.047 MicrosoftUpdate : Configured

And that tells me whether my Exchange server is up to date for anti-spam signatures.

Now that the solution is more apparent I am working on wrapping this into a single script that can be executed from a single server to report on all Hub Transport servers in the organisation.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Anti-Spam

Understanding the Exchange Server Spam Confidence Level

Related posts:

Review of GFI MailEssentials

Installing GFI MailEssentials

Key Features of GFI MailEssentials

Anti-Spam Protection

Administrative Features

Reporting and Monitoring

Email Management Features

Related posts:

Evaluating Anti-Spam Software

Related posts:

Backscatter Spam and Exchange Server 2007

Related posts:

Articles about Exchange Server and spam prevention

Related posts:

Spam quarantine features in Exchange Server 2007

Related posts:

How to configure Exchange Server 2007 Connection Filtering with SpamHaus

Related posts:

Event ID 454 and 17003 – A corrupt Sender Reputation database causes Exchange Server 2007 Transport service to stop

Related posts:

Exchange Server 2007 SP1 disables Exchange Anti-spam updates

Related posts:

Checking currency of Exchange Server 2007 Anti-Spam signatures

Related posts: