Integrating any Anti-Spam Filter into Exchange

Alexander Zammit

Software Development Consultant. Involved in the development of various Enterprise software solutions. Today focused on Blockchain and DLT technologies.

Plugging into Exchange 2003

IMF classifies processed emails using the Spam Confidence Levels (SCLs). This is just a numeric value from 0 to 9 reflecting the level of certainty the filter has on classifying an email as legitimate or spam. SCL0 is assigned to emails classified as legitimate. SCL9 is assigned to emails considered to be almost certainly spam. Values in between reflect a varying degree of certainty.

As we shall see SCL ratings are very important to our discussion. For more details I suggest you to read my article IMF SCL Configuration - getting it right

SCLs are the key to tap into Exchange. This is what Exchange understands. This is what determines when an email is to be deposited to the Junk Email folder. Hence any application wanting to plug into Exchange will need to somehow specify an SCL rating.

Do You Speak in SCLs?

It is quite obvious that a filter ignorant of Exchange won't generate SCLs. Nevertheless most filters will have some other way of expressing their email classification. Thus our goal becomes that of converting the filter specific email classification to an SCL. I have depicted the general setup below.

This is a very typical gateway filtering setup. Emails are first processed by the anti-spam filter. This adds its "spaminess" classification to each email. Next the mapping layer extracts and transforms this classification into an SCL. The emails are finally handed over to Exchange for delivery.

The email classification method is specific to the anti-spam solution adopted. Nevertheless it is safe to say that most filters are able to insert custom headers for this purpose.

The simplest scenario is the case where a flag is set through a custom header. For example the following could be inserted whenever an email is classified to be spam:

X-IS-SPAM: Yes

Legitimate emails would either have no header, or have the header value set to 'No'.

A more complicated scenario is when the filter adopts a broader range of values rather than a Yes/No flag. For example a percentage rating is sometimes adopted.

Another fairly common case is the insertion of tags within the email subject. Typically this is composed entirely (or in-part) of some fixed text. Through this text it is then possible to extract the filtering outcome.

Mapping Results with IMF Tune

IMF Tune provides the missing link. It is able to extract the filtering result and map it to an SCL. Let's see how we can get spam to be routed to the Junk Email Folder.

IMF Tune is an extension to the Exchange Intelligent Message Filter. Thus you would first start by installing IMF Tune and IMF on the same Exchange server. Note that as from Exchange SP2, IMF is an integral part of Exchange and there is no separate IMF install. Check the references section for all relevant links.

Next you need to configure IMF. I will assume you already know how to do this, otherwise check the references. To keep things simple I won't activate IMF gateway blocking. Thus I will set the gateway action to 'No Action' and the gateway threshold (which is irrelevant) to 9.

What is more interesting to us is the Junk Email threshold. I will set this to a relatively high value i.e. 6. This means that emails with SCLs greater than 6 will be deposited to the Junk Email folder.

The reason for this high threshold is the fact that here I am not really interested in IMF filtering. I will instead rely on the anti-spam filter sitting in front of Exchange.

Intelligent Message Filter Configuration

Of course don't forget to enable IMF from the Exchange System Manager under the SMTP Protocol. Note that as from SP2 IMF enablement was moved to SMTP Virtual Server | General | Advanced.

Next we configure IMF Tune. Open the configuration, select the SCL Management category and Click on Add. This opens the SCL Mapping dialog

What we configure here depends on the type of email classification supplied by the spam filter. If we consider the Yes/No header flag discussed earlier, then we would set:

Header Name:	X-IS-SPAM
Matching Type:	is exactly
Header Value:	yes
Operation Type:	set value to
SCL Value:	7

Next save the new mapping and select the IMF Tune General category. Here make sure that SCL 7 is configured as Accept. Otherwise IMF Tune itself might block email delivery.

That's basically it. Save changes and emails identified as spam will be routed to the Junk Email folder. Furthermore any Safe Senders/Recipients, Blocked Senders configured at the client will also be applied. As promised at the introduction there will be no difference between spam filtered by IMF and spam filtered at the edge.

IMF Tune through the SCL Mappings dialog also caters for more complex email classifications. For example we could search for a tag within the Subject or within any other email header using the 'contains' matching type. Of course the more complex the classification the more complex the configuration gets. So in general one should look at rendering this information as easy to process as possible.

For brevity here I described the setup of IMF and IMF Tune at one go. In general it is easier to first setup IMF, test it out to make sure it works properly and then proceed with IMF Tune.

To conclude, I want also to remind you of the classic Junk Email enablement problem that many run into. For emails to be deposited to this folder, it must be enabled on each mailbox. I discussed solutions to this issue in a recent article Centralizing Junk Email Folder Administration