?
Solved

IMF and Connection Filtering

Posted on 2012-04-04
3
Medium Priority
?
455 Views
Last Modified: 2012-04-12
We have an outside spam filtering service for our emails. Our MX records point to the spam filter and then the spam filter points to our mail server.

The outside spam filter wasn't doing a good enough job keeping the spam away. So, I set up the IMF filter on our exchange 2003 server.

The problem is that now we get have one or two email addresses that get blocked by our IMF that shouldn't. Of course, there is no whitelist built in to IMF so to pass false-positives through the IMF I either need a 3rd party tool or I need to use connection filtering.

I've used a few applications for whitelisting like IMFcompanion. It seems like none of them run as a service so as soon as I log out of the server the application closes and the whitelisting functionality stops.

Because of this I decided to try using connection filtering. But the emails are still getting blocked. I'll post the steps that I've taken to configure the connection filtering with hopes that maybe you will catch something that I'm missing.

1) open ESM and go to message delivery > Properties > Connection Filtering > Accept
2) type in the sending server's ip for the blocked emails, 67.50.177.26
3) go to SMTP virtual server > Properties > General > Advanced > Edit
4) I have checked:
                                 Apply Recipient Filter
                                 Apply Sender ID Filter
                                 Apply Intelligent Message Filter
                                 Apply Connection Filter
5) click Ok a few times to finish
6) restart SMTP service.

I've attached an email header from one of the blocked emails that shows the IP address of the blocked email server.
email-header.txt
0
Comment
Question by:David11011
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 17

Expert Comment

by:fgrushevsky
ID: 37808134
The connection filtering would not work for you.

It is designed not to accept connections from unwanted IPs, but all your connections are coming from external spam filtering provider.
You should also check that your firewall is configured to only allow connections from  external spam filtering provider to your Exchange server and there is no possibility for direct connection from any internet host to your Exchange (the spammers don't follow mx records)
0
 
LVL 2

Author Comment

by:David11011
ID: 37812007
Then does anyone happen to know of any good whitelisting utilities I can try out for our IMF on the mailserver?
0
 
LVL 17

Accepted Solution

by:
fgrushevsky earned 2000 total points
ID: 37815963
0

Featured Post

[Webinar] Lessons on Recovering from Petya

Skyport is working hard to help customers recover from recent attacks, like the Petya worm. This work has brought to light some important lessons. New malware attacks like this can take down your entire environment. Learn from others mistakes on how to prevent Petya like worms.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As cyber crime continues to grow in both numbers and sophistication, a troubling trend of optimization has emerged over the last year.
If you troubleshoot Outlook for clients, you may want to know a bit more about the OST file before doing your next job. IMAP can cause a lot of drama if removed in the accounts without backing up.
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…
Suggested Courses
Course of the Month10 days, 4 hours left to enroll

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question