MichaelBalack
asked on
Why the antispam features do not work in my Exchange server?
This is using MS Exchange server 2013. However, even that I already configured the antispam to work, I don't think it is working as none of the spam caught and sent to my quarantine mailbox. This is how I configure the antispam:
a. Open EMS, and browse to D:\Program Files\Microsoft\Exchange Server\v15\Scripts\;
double-click Install-antispamAgents.ps, to install antispam feature
b. In EMS, type get-transportagent:
c. In EMS, type get-transportconfig | fl internalSMTPServers; ensure the Exchange Server IP is included
d. In EMS, type get-transportservice | fl Agentlog*; to see the settings as follows:
- AgentLogMaxAge
- AgentLogDirectorySize
- AgentLogFileSize
- AgentLogPath
- AgentLogEnabled
e. In EMS, type get-contentfilterconfig | fl SCL*; to see the SCLs for Delete, Reject, and Quarantine:
- SCLDeleteThreshold (9); SCLDeleteEnabled (true)
- SCLRejectThreshold (8); SCLRejectEnabled (false)
- SCLQuarantineThreshold (6); SCLQuarantineEnabled (true)
f. In EMS, type get-OrganizationConfig | SCL*; to see the settings for SCLJunkThreshold:
- SCLJunkThreshold (5)
g. In EMS, type get-SenderIDConfig | fl Spoofed*; to see the settings:
- SpoofedDomainAction (StampStatus)
h. In EMS, type get-SenderReputationConfig | fl: to see the selective settings:
- SenderBlockingEnabled (true)
- SrlBlockThreshold (6) * default, 7
- SenderBlockingPeriod (36) * default, 24
i. In EMS, type get-SetSenderFilterConfig | fl Block*; to add in and see the current blocked sender and blocked sender domain:
Set-SenderFilterConfig -BlankSenderBlockingEnable d $true –BlockedDomainsAnd Subdomains lucernepublishing.com -BlockedSenders @{Add="user1@contoso.com", "user2@con toso.com"}
- BlankSenderBlockingEnabled (true)
j. In EMS, type get-IPBlockListProvider; to see list of RBL in descending priority:
Add-IPBlockListProvider:
- name (bl.spamcop.net); lookupdomain (bl.sampcop.net)
- name (bb.barracudacentral.org); lookupdomain (bb.barracudacentral.org)
- name (ix.dnsbl.manitu.net); lookupdomain (ix.dnsbl.manitu.net)
- name (combined.njabl.org); lookupdomain (combined.njabl.org)
- name (zen.spamhaus.org); lookupdomain (zen.spamhaus.org)
- name (psbl.surriel.net); lookupdomain (psbl.surriel.net)
k. In EMS, type get-IPAllowListProvider; to see list of RBL in descending priority:
Add-IPAllowListProvider:
- name (swl.spamhaus.org); lookupdomain (swl.spamhaus.org)
- name (iadb.isipp.com); lookupdomain (iadb.isipp.com)
- name (query.bondedsender.org); lookupdomain (query.bondedsender.org)
Anything I missed out?
a. Open EMS, and browse to D:\Program Files\Microsoft\Exchange Server\v15\Scripts\;
double-click Install-antispamAgents.ps,
b. In EMS, type get-transportagent:
c. In EMS, type get-transportconfig | fl internalSMTPServers; ensure the Exchange Server IP is included
d. In EMS, type get-transportservice | fl Agentlog*; to see the settings as follows:
- AgentLogMaxAge
- AgentLogDirectorySize
- AgentLogFileSize
- AgentLogPath
- AgentLogEnabled
e. In EMS, type get-contentfilterconfig | fl SCL*; to see the SCLs for Delete, Reject, and Quarantine:
- SCLDeleteThreshold (9); SCLDeleteEnabled (true)
- SCLRejectThreshold (8); SCLRejectEnabled (false)
- SCLQuarantineThreshold (6); SCLQuarantineEnabled (true)
f. In EMS, type get-OrganizationConfig | SCL*; to see the settings for SCLJunkThreshold:
- SCLJunkThreshold (5)
g. In EMS, type get-SenderIDConfig | fl Spoofed*; to see the settings:
- SpoofedDomainAction (StampStatus)
h. In EMS, type get-SenderReputationConfig
- SenderBlockingEnabled (true)
- SrlBlockThreshold (6) * default, 7
- SenderBlockingPeriod (36) * default, 24
i. In EMS, type get-SetSenderFilterConfig | fl Block*; to add in and see the current blocked sender and blocked sender domain:
Set-SenderFilterConfig -BlankSenderBlockingEnable
- BlankSenderBlockingEnabled
j. In EMS, type get-IPBlockListProvider; to see list of RBL in descending priority:
Add-IPBlockListProvider:
- name (bl.spamcop.net); lookupdomain (bl.sampcop.net)
- name (bb.barracudacentral.org);
- name (ix.dnsbl.manitu.net); lookupdomain (ix.dnsbl.manitu.net)
- name (combined.njabl.org); lookupdomain (combined.njabl.org)
- name (zen.spamhaus.org); lookupdomain (zen.spamhaus.org)
- name (psbl.surriel.net); lookupdomain (psbl.surriel.net)
k. In EMS, type get-IPAllowListProvider; to see list of RBL in descending priority:
Add-IPAllowListProvider:
- name (swl.spamhaus.org); lookupdomain (swl.spamhaus.org)
- name (iadb.isipp.com); lookupdomain (iadb.isipp.com)
- name (query.bondedsender.org); lookupdomain (query.bondedsender.org)
Anything I missed out?
ASKER
Hi Alexander,
Yes, transport service was restarted.
Give me some times to look into the link.
Yes, transport service was restarted.
Give me some times to look into the link.
ASKER
Hi Alexander,
Sorry for the delay due to the long lunar chinese new year. I'll look into it tonite.
Sorry for the delay due to the long lunar chinese new year. I'll look into it tonite.
ASKER
Hello,
I think that you didn't set a command parameter.
http://social.technet.microsoft.com/wiki/contents/articles/19122.exchange-server-how-to-diagnose-spam-problem.aspx
I think that you didn't set a command parameter.
You can run this script to draw a report for the Exchange Anti Spam Agents. The following values are accepted as command parameters:http://www.proexchange.be/blogs/exchange2010/archive/2011/12/18/the-exchange-2010-scripts.aspx
messagesrejected
messagesdeleted
connections
messagesquarantined
Usage:
.\Get-AntispamFilteringReport.ps1 <command> –report <path>
http://social.technet.microsoft.com/wiki/contents/articles/19122.exchange-server-how-to-diagnose-spam-problem.aspx
ASKER
Hi Alexander,
I typed ".\get-antispamfilteringre port.ps1 messagesrejected c:\drivers\antispam_1.txt" , and error occurred.
I typed ".\get-antispamsclhistogra m.ps1" and the following table displayed:
name value
1 1
8 1
0 3
7 32
not availble: content filtering bypassed 67
Any comment?
I typed ".\get-antispamfilteringre
I typed ".\get-antispamsclhistogra
name value
1 1
8 1
0 3
7 32
not availble: content filtering bypassed 67
Any comment?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Specially thanks to Alessandro for his patience and efforts. I started to receive spams being quarantined day by day. These are trully spams.
Did you restart "MsExchange Transport Service" service to take effect?
To verify you could check statistics of your Anti-Spam filters by Get-AntiSpamFilteringRepor
https://technet.microsoft.com/en-us/library/bb124795%28v=exchg.150%29.aspx