Exchange Server Pro » Anti-Spam

Exchange 2010 Edge Transport Server: Configuring IP Block List Providers

Paul Cunningham — Sat, 14 May 2011 11:16:44 +0000

The Exchange Server 2010 Edge Transport server role is automatically enabled for the built-in anti-spam features when it is installed. However some of the features require configuration before they can begin blocking spam.

The IP Block List Providers anti-spam feature is one example. It is enabled by default, but no block list providers are included in the configuration.

IP block list providers are an effective way to block the majority of spam, because they maintain comprehensive databases of IP addresses on the internet that are known and suspected spam sources. This allows an Exchange server to determine whether or not to block an incoming email during the initial stages of the SMTP connection, based on the IP address of the sending host.

Blocking spam at such an early stage of the communication sequence uses less bandwidth and processor resources than email content filtering, because the full email message is never transmitted to the Exchange server.

One of the best IP block list providers is Spamhaus. You can configure an Edge Transport server to use Spamhaus as an IP block list provider by following these steps.

Log on to your Edge Transport server and launch the Exchange Management Console. In the Anti-spam tab right-click IP Block List Providers and select Properties.

Select the Providers tab and then click Add.

Enter the Provider Name of Spamhaus and the Lookup Domain of zen.spamhaus.org.

Click OK and OK again to apply the change.

The Edge Transport server will now lookup the IP address of connecting hosts to determine whether or not to accept mail from them.

Get more Exchange Server tips at ExchangeServerPro.com

Vircom modusGate and directQuarantine Review

Paul Cunningham — Sat, 30 Apr 2011 14:01:21 +0000

Despite all the talk in the industry about moving services to the cloud most clients that I work with still use an on-premise email security server for protecting their Exchange servers.

modusGate by Vircom is an email security product that includes anti-spam and anti-virus protection, as well as a range of other useful security and administrative features that are configurable to an impressive depth.

Installing modusGate

For this review I installed modusGate on a Windows Server 2008 32-bit server running in my virtual test lab environment. Virtualizing modusGate is supported but it can also run comfortably on low-spec servers for smaller deployments.

One of the first things I like to do with new software is just run the installer to see how it handles pre-requisites. So I was immediately pleased to see the modusGate installer offer to install missing system requirements for me.

After the license agreement there is the usual Standard and Custom install options. I allowed the Standard installation to run and chose to use SQL Express, but there is also the option to use a SQL Server if you have one available in your network.

After the installation wizard completed a HTML page opened with the next steps to take to configure modusGate.

Configuring modusGate Email Routing

Adding routes for your email domains to the modusGate server is fairly simple thanks to a wizard.

I thought a few of the settings it needed were a little ambiguous in their meaning but the documentation quickly cleared up my confusion and kept me moving. But anyone with some basic understanding of LDAP and Active Directory would have no trouble with this process.

Although modusGate supports Exchange Server 2010 it only displays Exchange 2007 as an option for configuring mail routing. It does work fine though and a later configuration screen includes Exchange 2010 in the list.

The only issue I encountered during setup was the IP address I specified for a domain controller somehow switched back to the IP of the Exchange server. Initially this meant that test emails didn’t work but once I corrected the IP address it began working correctly.

Configuring modusGate Protection

modusGate comes with all of the protection features that you want to see in an email security product such as RBL filtering, Sender Reputation, and dictionary attack prevention, as well as whitelisting options for trusted IP addresses and senders.

Anti-virus/malware protection is also built-in to modusGate.

Although a few settings need to be enabled and configured by the administrator most of the sensible protection options for spam and malware are turned on by default. So modusGate will begin protecting your environment immediately, but also has plenty of options for tuning and tweaking the protection to suit the unique characteristics of your organization’s email.

One other thing I’ll mention is the neat Smail utility that Vircom provides for testing email traffic to the modusGate server. Just a simple tool that will help a lot of administrators who don’t know how to use Telnet to test SMTP, and for those that do know it is a lot faster using Vircom’s tool anyway.

I also like that modusGate includes a feature for encrypting email in transit. Email encryption between specific networks is something that several customers I’ve worked with in the past have wanted, so that they can securely transmit sensitive email between trusted partners. On more than one occasion the limitations of a particular email server or security product at one end or the other has prevented this from being deployed.

modusGate Web Reporting

In my strong opinion good reporting capabilities are a must have for any email security product. modusGate covers this off nicely with a web reporting interface that comes with a series of useful standard reports.

You can also have reports emailed to people on a scheduled basis which is a good way to distribute email security reports to non-administrators.

modusGate and directQuarantine

A challenge for IT departments when implementing an email security product is to balance the protection of the email environment with the need to reduce false positives. When IT administrators are burdened with quarantine management it can create problems for the business – the users do not realize they haven’t received an important email, and when they finally do realize it then takes more time for the IT administrators to respond and release the item from quarantine.

End user quarantine access is the solution to this problem. modusGate does come with a web interface for end user quarantine, as well as scheduled email notifications to alert end users about quarantined items. But these are still not the best solution.

So Vircom has developed a new feature for modusGate called directQuarantine, which installs as an Outlook add-in and gives the end user simpler and more immediate control of their quarantine.

Deploying the add-in was quite simple thanks to Vircom providing a surprisingly detailed guide for deploying via GPO. Some vendors simply provide the MSI files and leave you to it, which is not good for administrators who aren’t experienced in automating software installation.

Summary

I’ve worked with a lot of different email security products, and overall I found modusGate to be quite easy to install, configure and administer. Like most products modusGate has its own unique take on administrative interfaces but I quickly became familiar with it.

I found the modusGate documentation to be actually quite good, a step above most other products out there. This is important because as I mentioned earlier most email security products have their own unique way of doing things, so having clear documentation is important.

The pricing for modusGate and directQuarantine make them both cost effective choices even for small businesses. And the different deployment models make modusGate scalable to large organizations as well.

I contacted Vircom Support once during my review and got a speedy response from a knowledgeable person.

Overall I would certainly recommend modusGate and directQuarantine for businesses who are looking for an email security product to protect their Exchange Server environment.

Disclosure: Vircom is a paid advertiser on this website.

Screenshot Gallery:

Click to Show »

Get more Exchange Server tips at ExchangeServerPro.com

What Are You Telling Customers About the Epsilon Data Breach?

Paul Cunningham — Sat, 09 Apr 2011 22:18:00 +0000

The big news in the anti-spam world lately has been the customer data breach at Epsilon. You may never have heard of Epsilon before this incident, so here is a quick description of them by Ken Magill.

Epsilon is the largest permission-based email marketing services provider in the world. According to the company’s Web site, it sends more than 40 billion emails annually for more than 2,500 clients, including seven of the Fortune 10.

The data breach first came to widespread attention as major brands such as Hilton, Tivo and Dell began emailing their customers to warn them that their email addresses had been compromised.

This is nothing new in the world of email marketing, high profile data breaches have occurred in recent years with email providers such as iContact and Aweber (twice) and there is a longer history of them dating back to 2005 and 2002. And thats just a few of the ones we actually hear about.

It should come as no surprise that databases of active, verified email addresses are a rich target for data thieves, just as other targets such as the companies that issue SSL certificates or make security tokens are also highly targeted.

The thought of your email addresses being compromised in this way might alarm some customers. But what is the real impact? More spam?

As I explained to one of my customers, if you have an email address then there is a pretty good chance the spammers already have it. In this particular case an office of only 8 staff has close to 40,000 spam emails blocked each month. A few new spammers getting hold of those email addresses might increase the volume of spam a little.

But as long as that spam is still spam-like then it stands no greater chance of making it past the anti-spam protection our customers already have. In other words if the spam is still coming from untrusted IP addresses such as botnets, contains content that will be filtered, or links out to malicious URLs, then you can expect it to be blocked just like other spam.

The real risk is if the spammers are able to construct spam emails that make it past the anti-spam filters, which as we all know does happen from time to time. Depending on the extent of the Epsilon data breach the spammers may also be in possession of information that makes it easier to trick the receiver into believing it is a legitimate email.

For example of the spammer knows your email address and your real name and which companies you’ve done business with and therefore expect to receive email from, then they can craft a more personalized and relevant spam email to send to you.

So while most people would recognize an email from a bank that they aren’t a customer of as spam, if the same email appeared to come from the bank that they do use and addresses them by their real name then the phishing attempt may be more successful.

All of this places the weakest link (aside from the apparently flawed security of email service providers) at the same place it has always been – the end user and their awareness of issues around spam, social engineering, and phishing.

Unfortunately these are complex issues and as Laura Wise recently showed it can be hard enough for an expert in this field to tell real email from fake. Worse still some companies send legitimate email that easily fits the profile of a phishing attempt.

So what are you telling your customers about this?

Get more Exchange Server tips at ExchangeServerPro.com

Understanding the Exchange Server Spam Confidence Level

Paul Cunningham — Wed, 23 Jun 2010 14:05:47 +0000

If you have looked at Exchange Server’s anti-spam features or taken a peek at the headers of an email sent through an Exchange server you have probably encountered the term SCL before.

SCL stands for Spam Confidence Level. It is the “score” that Exchange Server anti-spam assigns to an email based on the email’s contents. This score is then used to make decisions as to how to handle suspected spam based on the thresholds that the Exchange administrator configures.

Having a detailed understanding of the SCL and how it is used in Exchange Server anti-spam will allow an email administrator to get good performance from their anti-spam deployment.

Review of GFI MailEssentials

Paul Cunningham — Tue, 12 Jan 2010 12:22:20 +0000

GFI MailEssentials is an anti-spam and email management product from GFI Software.

MailEssentials boasts 99% accuracy for spam detection thanks to its two anti-spam engines, and at the same time a very low rate of false positives thanks to Bayesian filtering. The software also includes several useful email management features such as disclaimers, auto-responders, and archiving.

Installing GFI MailEssentials

The latest version 14.1 of MailEssentials is compatible with both Exchange Server 2007 and 2010, or can be installed on a standalone SMTP server.

When installing on an Exchange server most of the pre-requisites will aready have been met, but you may find you need to install the MAPI Client and Collaboration Data Objects available from Microsoft’s download site as well. The installer can also automatically install the MSMQ pre-requisite if you haven’t already installed it.

The installation is then a breeze with the only significant choice being whether to enable Active Directory integration or to install MailEssentials as a DMZ server with no AD access.

After the installation is finished an intial configuration wizard is launched. Here you can specify the SMTP domains to protect with MailEssentials.

The Exchange Server roles are automatically detected and that determines which of the MailEssentials components get installed.

The initial configuration wizard only takes a moment to finish, and GFI MailEssentials is now set up and ready for use.

Key Features of GFI MailEssentials

Anti-Spam Protection

The default configuration of MailEssentials provides immediate spam detection using the SpamRazer engine, phishing protection, and prevention of directory harvest attacks. The server is also configured with DNS RBL services and default sender and keyword filtering policies to block well known spam patterns.

Bayesian training is automatically enabled and monitors outgoing emails. This helps the Bayesian filter learn what sort of email content is likely to be legitimate for the organization. When this intelligence is combined with the frequent spam data updates from GFI it keeps false positives to an absolute minimum.

Administrative Features

Administrative burden is greatly reduced by offering end user self-service options via the Exchange Public Folders. Email users can help train the Bayesian filter using drag-and-drop to move email items between different Public Folders which then tells the server whether the item is spam or not.

In addition when spam is detected it can be delivered to folders within the user mailbox or the Public Folder store, giving users access to the quarantine to review their own spam.

Reporting and Monitoring

GFI MailEssentials includes a real-time monitoring dashboard as well as an easy to use reporting interface so that you can measure the performance of its anti-spam features.

Email Management Features

One of the best features MailEssentials provides for Exchange Server 2007 environments is email disclaimers that can be configured on a per-domain or per-user basis.

Exchange Server 2007 can do disclaimers using Transport Rules but these are limited to text only, whereas GFI MailEssentials permits HTML disclaimers and a set of variables that can be used to create much richer, more dynamic disclaimers.

The MailEssentials disclaimer feature also continues to work after the product trial period has ended, so it can be used as a free disclaimer add-on for any Exchange 2007 or 2010 environment.

GFI MailEssential is available as a full featured 30 day trial for download from GFI Software. MailEssentials is also available as a free email disclaimer tool for Exchange Server 2007 and 2010.

Get more Exchange Server tips at ExchangeServerPro.com

Evaluating Anti-Spam Software

Paul Cunningham — Wed, 27 May 2009 20:39:54 +0000

I used to do some work for a customer who’s idea of running an evaluation of a new system was to pick one product, put it in, then if it sort of worked good enough to just buy that one. Over the long term some of these choices turned out to be less than ideal.

Over at AllSpammedUp.com I’ve written a high level approach to evaluating anti-spam products for businesses.

If you are considering anti-spam solutions for your business it is important to take the time and evaluate possible solutions properly. Remember these basic steps:

Learn about which products are available on the market

Contact vendors to discuss your needs and access demonstrations and pre-sales support

Perform a testing phase before the evaluation phase

Utilise trial licenses of Windows, Exchange, and the anti-spam software, along with spare hardware or a VMWare environment to reduce the impact on production systems

Evaluate all features thoroughly and consistently across the different products

By performing a proper evaluation of anti-spam products you greatly increase the chances that you will implement the product that is the best fit for your organisation.

Read the full article here.

Get more Exchange Server tips at ExchangeServerPro.com

Backscatter Spam and Exchange Server 2007

Paul Cunningham — Wed, 29 Apr 2009 18:20:56 +0000

Over at AllSpammedUp.com I’ve written an article on protecting both yourself and others from backscatter spam. Backscatter spam is also known as NDR spam and is the result of address spoofing combined with spam addressed to invalid recipients. As an Exchange administrator you want to be sure you aren’t contributing to the problem with your own email server.

Read the full article.

Get more Exchange Server tips at ExchangeServerPro.com

Articles about Exchange Server and spam prevention

Paul Cunningham — Tue, 17 Feb 2009 20:00:26 +0000

I’ve written some more articles recently at AllSpammedUp.com. One of the interesting things about writing these articles is that is has forced me to take a deeper look at Exchange Server 2007 antispam features and consider their effectiveness. My view at the moment is that with the right attention and configuration Exchange Server 2007 can do a good job at preventing spam, but still falls short of most of the better third party products available.

Get more Exchange Server tips at ExchangeServerPro.com

Spam quarantine features in Exchange Server 2007

Paul Cunningham — Sat, 27 Dec 2008 11:04:30 +0000

With the right configuration and ongoing tuning the built in Exchange Server 2007 anti-spam features can be effective in many environments. One thing I’m not a fan of though is the quarantine feature. You can read more about it in my latest post to AllSpammedUp.com here.

Link: Managing spam quarantine for Exchange Server 2007

Get more Exchange Server tips at ExchangeServerPro.com

How to configure Exchange Server 2007 Connection Filtering with SpamHaus

Paul Cunningham — Sun, 14 Dec 2008 20:41:53 +0000

Over at AllSpammedUp.com I’ve written an article on the Exchange 2007 Connection Filter agent, and I walk through the steps to configure it to use SpamHaus as an IP Block list provider.

A correctly configured Connection Filter agent saves the Exchange administrator a lot of time by avoiding the need to manually maintain a large list of blocked and allowed IP addresses. The Connection Filter agent also reduces server load by rejecting likely spam before it has been transmitted to the Exchange server and without requiring resource-intensive content scanning of the email message.

Read the full article here.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Anti-Spam

Exchange 2010 Edge Transport Server: Configuring IP Block List Providers

Related posts:

Vircom modusGate and directQuarantine Review

Installing modusGate

Configuring modusGate Email Routing

Configuring modusGate Protection

modusGate Web Reporting

modusGate and directQuarantine

Summary

Related posts:

What Are You Telling Customers About the Epsilon Data Breach?

Related posts:

Understanding the Exchange Server Spam Confidence Level

Related posts:

Review of GFI MailEssentials

Installing GFI MailEssentials

Key Features of GFI MailEssentials

Anti-Spam Protection

Administrative Features

Reporting and Monitoring

Email Management Features

Related posts:

Evaluating Anti-Spam Software

Related posts:

Backscatter Spam and Exchange Server 2007

Related posts:

Articles about Exchange Server and spam prevention

Related posts:

Spam quarantine features in Exchange Server 2007

Related posts:

How to configure Exchange Server 2007 Connection Filtering with SpamHaus

Related posts: