The Microsoft Intelligent Message Filter is known to only process inbound SMTP emails. Many small businesses host their domain mailboxes externally and rely on POP3 or IMAP to periodically retrieve emails. This may easily lead us to believe that such traffic falls beyond the reach of IMF. However overcoming this limitation is quite easy.
Microsoft Small Business Server users are certainly aware of the POP3 connector included in the SBS package. Being readily available many adopt this. Unfortunately this connector feeds emails into Exchange through the IIS SMTP pickup folder bypassing IMF processing.
If you are expecting some hack to transform IMF, you are out of luck. We simply require a POP3/IMAP connector that forwards downloaded emails over a regular SMTP connection. Indeed this is how most commercial POP3 connectors work. Emails now enter Exchange through the inbound SMTP interface where IMF is waiting to do its job.
So the first step is for us to give up the SBS connector. Luckily much better alternatives are available for as little as $100. For such a small price we can get:
A much more reliable connector
Intelligent Message Filter anti-spam
I won't get into the SBS connector reliability issues here. Just search the SBS newsgroups for more on this topic. Instead we focus on the details of running IMF in such a setup.
IMF Configuration
Although a connector can do a good job at transforming POP3 into SMTP traffic, there is one important fact to keep in mind. The Exchange anti-spam functionality was meant to handle "normal" inbound SMTP traffic. Normal here refers to the case where the original email sender connects directly to Exchange. This is not what happens in our case. Both legitimate senders and spammers will post emails to the external mailbox unobstructed. The connector downloads and attempts delivery to the Exchange mailboxes where spam is being filtered. Thus the anti-spam filter never interacts with the original sender.
This difference limits our filtering options. Specifically email rejection takes a completely new meaning. Let's see what happens when an email is rejected in "normal" SMTP email delivery. In this case the remote sending SMTP server receives a rejection response from which a non-delivery report NDR may be generated to notify the original email sender.
In case of a POP3 to SMTP connector, Exchange is not interacting with the sender's SMTP server. The SMTP connection is established between Exchange and the connector. Rejections are now received by the connector who is trying to deliver the emails just downloaded.
At this point rejection handling entirely depends on the connector implementation. Many connectors will simply try to deliver the email to the postmaster mailbox. This is just another mailbox within our Exchange server. The anti-spam filter is likely to again reject it. If that were not to be the case the postmaster mailbox would quickly get flooded.
So the conclusion here is that email rejection is best avoided. To see how this affects the Intelligent Message Filter (IMF) let's have a look at the configuration under Global Settings | Message Delivery | Intelligent Message Filtering.
Gateway blocking allows us to select between Reject, Delete, Archive and No Action. Just make sure to avoid the Reject action. All other actions will work as usual. Same goes for the Store Junk E-mail configuration, this will work as expected. For a more complete discussion on IMF configuration refer to the links at the references section.
Final Tips
The myth that IMF cannot filter POP3 emails unfortunately keeps some organizations away from it. The fact that the Microsoft Small Business Server POP3 connector bypasses IMF tends to reenforce this myth. However the truth turns out to be different. As we have seen, routing emails through the Intelligent Message Filter is easy. Furthermore the same applies to any other non-SMTP emails as long as the right connector is in place.
References
IMF SCL Configuration - getting it right
Looking at IMF through the Performance Monitor
Troubleshooting IMF v2