Exchange Server SPAM Filtering

StarTraveller · 07-31-2002, 04:15 AM

Does anyone here have any experience with SPAM filter plug-ins for Exchange Server?

I'm looking for a good one and some tips on configuring it.

I searched Google, but the wealth of hits sort of scared me away. I'd like to hear about your experiences and your recommendations in stead

.

DJD · 07-31-2002, 04:39 AM

Hey m8! I dont know much about that... but here is a very nice article explaining how you can have a more secure exchange by closing the open relay.

StarTraveller · 07-31-2002, 06:23 AM

Thanks!

However, I'm not really the administrator of the server. I don't have access to making configuration changes and stuff like that...

I just promised to look for a good SPAM filter plug-in

.

StarTraveller · 08-07-2002, 10:22 AM

Don't we have any Exchange Server admins who fight spam on these forums

.

jcash · 08-07-2002, 10:34 AM

We let our WorldSecure (version 4.7) firewall handle SPAM..

Rules based filter that takes care of AV and content filtering.

Exchange is inside of the firewall, so EVERTHING must pass through the Gaulent FW and WorldSecure.

StarTraveller · 08-07-2002, 10:37 AM

How successful is that filter, jcash? E.g. how much of the junk mail does it filter out and does it have problems with false positives?

And how much of a hassle is it to learn to configure?

jcash · 08-07-2002, 10:49 AM

The nature of SPAM makes ALL "rules based" systems, less effictive that desired.
(Translation: It sucks)

It is difficult to setup and maintain, because spam is generated from 1,000,000+ points on the internet.

I will say that the "content Filter" is better. Load a table of "questionalble" words, phrases, web-sites...and it blocks those quite well.

False positives.....a few, but after you figure out WHY, you can re-set the rules to allow to pass....Example: CUM is an abbreviation we use in our business....and guess what...that is in the STANDARD list of 'BAD WORDS'. We actually lost a customer because we didn't receive his order.

StarTraveller · 08-07-2002, 10:58 AM

I don't necessarily have anything against a rule based system. Although it implies that the initial setup will be tough.

I think a decent system would be one where you can black/white list specific senders and/or general domains. And then combine that with an email every 2-3 days summing up what has been quarantined (so users have a chance to "revive" false positives).

I know the Computer Science department at my uni uses something like that (not for Exchange, though) and it filters out something like 40% of the total incoming mail

and they have very few problems with false positives after setting up the white lists properly.

I'm actually fairly impressed by the built-in junk mail recognition of Outlook XP. Together with my own black list setup it keeps my inbox as clean as I think is possible

.

**Gorganzola** · 08-07-2002, 11:05 AM

Would something like this:

http://www.winnetmag.com/Techware/In...ID=22&log=true

work for you?

**Gorganzola** · 08-07-2002, 11:06 AM

Or, this:

http://www.gfi.com/mes/index.html

StarTraveller · 08-07-2002, 11:09 AM

They look good and that's the problem.

I would like to hear from someone using a system that they want to recommend because the print on those retail boxes are pretty much the same

.

**Gorganzola** · 08-07-2002, 11:10 AM

hehe, I follow what you are getting at.

07-31-2002, 04:15 AM	#1
StarTraveller Retired Modder Join Date: Apr 2001 Location: Cloud Nine Posts: 6,494	Exchange Server SPAM Filtering Does anyone here have any experience with SPAM filter plug-ins for Exchange Server? I'm looking for a good one and some tips on configuring it. I searched Google, but the wealth of hits sort of scared me away. I'd like to hear about your experiences and your recommendations in stead . __________________ MSc at last! Read all about my highly acclaimed thesis (in Danish) about a method for evaluating teaching. An English version of the web site is also available. StarTraveller.net - see Computers for current setup! Well, it used to be current... Right now, my primary computer is a ThinkPad T43p 2668-H7U upgraded to 2 GB RAM Motto: If it is worth doing then it is worth doing right! Caution: The light at the end of a tunnel may be an oncoming train...
(Offline)

07-31-2002, 04:39 AM	#2
DJD A proud Labber Join Date: Jun 2002 Location: Athens, Greece Posts: 1,085	Hey m8! I dont know much about that... but here is a very nice article explaining how you can have a more secure exchange by closing the open relay. __________________ TheLab.gr *-Coz big boys will never stop playing!*
(Offline)

07-31-2002, 06:23 AM	#3
StarTraveller Retired Modder Join Date: Apr 2001 Location: Cloud Nine Posts: 6,494	Thanks! However, I'm not really the administrator of the server. I don't have access to making configuration changes and stuff like that... I just promised to look for a good SPAM filter plug-in . __________________ MSc at last! Read all about my highly acclaimed thesis (in Danish) about a method for evaluating teaching. An English version of the web site is also available. StarTraveller.net - see Computers for current setup! Well, it used to be current... Right now, my primary computer is a ThinkPad T43p 2668-H7U upgraded to 2 GB RAM Motto: If it is worth doing then it is worth doing right! Caution: The light at the end of a tunnel may be an oncoming train...
(Offline)

08-07-2002, 10:22 AM	#4
StarTraveller Retired Modder Join Date: Apr 2001 Location: Cloud Nine Posts: 6,494	BUMP Don't we have any Exchange Server admins who fight spam on these forums . __________________ MSc at last! Read all about my highly acclaimed thesis (in Danish) about a method for evaluating teaching. An English version of the web site is also available. StarTraveller.net - see Computers for current setup! Well, it used to be current... Right now, my primary computer is a ThinkPad T43p 2668-H7U upgraded to 2 GB RAM Motto: If it is worth doing then it is worth doing right! Caution: The light at the end of a tunnel may be an oncoming train...
(Offline)

08-07-2002, 10:34 AM	#5
jcash ~Not an Expert~ Join Date: May 2002 Posts: 1,678	We let our WorldSecure (version 4.7) firewall handle SPAM.. Rules based filter that takes care of AV and content filtering. Exchange is inside of the firewall, so EVERTHING must pass through the Gaulent FW and WorldSecure.
(Offline)

08-07-2002, 10:37 AM	#6
StarTraveller Retired Modder Join Date: Apr 2001 Location: Cloud Nine Posts: 6,494	How successful is that filter, jcash? E.g. how much of the junk mail does it filter out and does it have problems with false positives? And how much of a hassle is it to learn to configure? __________________ MSc at last! Read all about my highly acclaimed thesis (in Danish) about a method for evaluating teaching. An English version of the web site is also available. StarTraveller.net - see Computers for current setup! Well, it used to be current... Right now, my primary computer is a ThinkPad T43p 2668-H7U upgraded to 2 GB RAM Motto: If it is worth doing then it is worth doing right! Caution: The light at the end of a tunnel may be an oncoming train...
(Offline)

08-07-2002, 10:49 AM	#7
jcash ~Not an Expert~ Join Date: May 2002 Posts: 1,678	The nature of SPAM makes ALL "rules based" systems, less effictive that desired. (Translation: It sucks) It is difficult to setup and maintain, because spam is generated from 1,000,000+ points on the internet. I will say that the "content Filter" is better. Load a table of "questionalble" words, phrases, web-sites...and it blocks those quite well. False positives.....a few, but after you figure out WHY, you can re-set the rules to allow to pass....Example: CUM is an abbreviation we use in our business....and guess what...that is in the STANDARD list of 'BAD WORDS'. We actually lost a customer because we didn't receive his order.
(Offline)

08-07-2002, 10:58 AM	#8
StarTraveller Retired Modder Join Date: Apr 2001 Location: Cloud Nine Posts: 6,494	I don't necessarily have anything against a rule based system. Although it implies that the initial setup will be tough. I think a decent system would be one where you can black/white list specific senders and/or general domains. And then combine that with an email every 2-3 days summing up what has been quarantined (so users have a chance to "revive" false positives). I know the Computer Science department at my uni uses something like that (not for Exchange, though) and it filters out something like 40% of the total incoming mail and they have very few problems with false positives after setting up the white lists properly. I'm actually fairly impressed by the built-in junk mail recognition of Outlook XP. Together with my own black list setup it keeps my inbox as clean as I think is possible . __________________ MSc at last! Read all about my highly acclaimed thesis (in Danish) about a method for evaluating teaching. An English version of the web site is also available. StarTraveller.net - see Computers for current setup! Well, it used to be current... Right now, my primary computer is a ThinkPad T43p 2668-H7U upgraded to 2 GB RAM Motto: If it is worth doing then it is worth doing right! Caution: The light at the end of a tunnel may be an oncoming train...
(Offline)

08-07-2002, 11:05 AM	#9
Gorganzola ABXZone > Facebook Join Date: May 2001 Location: Hangin' with the fruits Posts: 9,510	Would something like this: http://www.winnetmag.com/Techware/In...ID=22&log=true work for you? __________________ TTFN. I wasn't asleep at the switch, I was drunk. -- Homer J. Simpson Q. How many dull people does it take to change a lightbulb? A. One. A very useful tool on these forums: You can Meebo in public.
(Offline)

08-07-2002, 11:06 AM	#10
Gorganzola ABXZone > Facebook Join Date: May 2001 Location: Hangin' with the fruits Posts: 9,510	Or, this: http://www.gfi.com/mes/index.html __________________ TTFN. I wasn't asleep at the switch, I was drunk. -- Homer J. Simpson Q. How many dull people does it take to change a lightbulb? A. One. A very useful tool on these forums: You can Meebo in public.
(Offline)

08-07-2002, 11:09 AM	#11
StarTraveller Retired Modder Join Date: Apr 2001 Location: Cloud Nine Posts: 6,494	They look good and that's the problem. I would like to hear from someone using a system that they want to recommend because the print on those retail boxes are pretty much the same . __________________ MSc at last! Read all about my highly acclaimed thesis (in Danish) about a method for evaluating teaching. An English version of the web site is also available. StarTraveller.net - see Computers for current setup! Well, it used to be current... Right now, my primary computer is a ThinkPad T43p 2668-H7U upgraded to 2 GB RAM Motto: If it is worth doing then it is worth doing right! Caution: The light at the end of a tunnel may be an oncoming train...
(Offline)

08-07-2002, 11:10 AM	#12
Gorganzola ABXZone > Facebook Join Date: May 2001 Location: Hangin' with the fruits Posts: 9,510	hehe, I follow what you are getting at. __________________ TTFN. I wasn't asleep at the switch, I was drunk. -- Homer J. Simpson Q. How many dull people does it take to change a lightbulb? A. One. A very useful tool on these forums: You can Meebo in public.
(Offline)

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode