Anti spam Filters not working at all????

Hi,

 

I have set up Exchange 2007 on a 64bit Windows 2008 platform. All latest SP's applied etc..

I have only the 1 server and have used the command applets to configure the anti spam. I have updates working properly, the latest updates came in at 9:20 this morning accrding to the event viewer. Everything looks like it is set up but it is not stopping spam!!!!!

Topology:

Mail comes through our ISA server to our Exchange 2003 server. For those few mailboxes which I have migrated to 2007 it is then sent on via connectors etc....

2007 server only runs the Hub transport but I have manually set up spam.

In the shell I have run some tests - here are the outputs:

[PS] C:\Users\mattadmin\Desktop>get-contentfilterconfig

Name                                  : ContentFilterConfig
RejectionResponse                     : Message rejected as spam by Content Filtering.
OutlookEmailPostmarkValidationEnabled : False
BypassedRecipients                    : {}
QuarantineMailbox                     : Spam.Quarantine@*********.com
SCLRejectThreshold                    : 7
SCLRejectEnabled                      : False
SCLDeleteThreshold                    : 9
SCLDeleteEnabled                      : False
SCLQuarantineThreshold                : 5
SCLQuarantineEnabled                  : True
BypassedSenders                       : {}
BypassedSenderDomains                 : {}
Enabled                               : True
ExternalMailEnabled                   : True
InternalMailEnabled                   : True
AdminDisplayName                      :
ExchangeVersion                       : 0.1 (8.0.535.0)
DistinguishedName                     : CN=ContentFilterConfig,CN=Message Hygiene,CN=Transport Settings,CN=********,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=*********,DC=co,DC=uk
Identity                              : ContentFilterConfig
Guid                                  : fb310ccf-03bf-4a6b-9c63-0b82c356ef8f
ObjectCategory                        : ***********/Configuration/Schema/ms-Exch-Message-Hygiene-Content-Filter-Config
ObjectClass                           : {top, msExchAgent, msExchMessageHygieneContentFilterConfig}
WhenChanged                           : 15/07/2008 15:38:50
WhenCreated                           : 18/06/2008 15:29:46
OriginatingServer                     : DC2.************.co.uk
IsValid                               : True

So you can see it is set up to use the spam.quarantine mail box for messages with an SCL > 5 for all message sincluding internal. (I have tried this set to 2 but still no joy) I turned of Outlook Postmark Validation to try and increase the spam score!!

[PS] C:\Users\mattadmin\Desktop>get-antispamupdates

UpdateMode                  : Automatic
LatestContentFilterVersion  : 3.3.6714.600
SpamSignatureUpdatesEnabled : True
LatestSpamSignatureVersion  : 3.3.4604.600
IPReputationUpdatesEnabled  : True
LatestIPReputationVersion   : 3.3.6715.036
MicrosoftUpdate             : Configured

Seems up to date.....

[PS] C:\Users\mattadmin\Desktop>get-contentfilterphrase

Influence   : BadWord
Phrase      : slartibartfast
Identity    : slartibartfast
IsValid     : True
ObjectState : Unchanged

A bad word to test with!!! )

OK - in testing this I find than all mail messages, both internal and external, which contain the word slartibartfast are being delivered, not stopped as spam. I cant see why this is happening?

When I look at the headers of the message delivered to the test mail box I see this -  (Plus usual header stuff):

X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Organization-Antispam-Report: MessageSecurityAntispamBypass

For external messages it looks like this:

X-SpamReason: No, hits=0.4 required=7.0 tests=FORGED_HOTMAIL_RCVD,
and
X-MS-Exchange-Organization-Antispam-Report: MessageSecurityAntispamBypass
X-MS-Exchange-Organization-SCL: -1

Don't understand the top line! Required=7??? I set it to 5 as you can see above!

Can anyone see where I have gone wrong? I don't understand why these messages are bypassing the spam scanning? I have not set up any bypasses. How do I check this?

Any help would be very much apreciated, this is driving me mad!


Many thanks