Hi expert,

I'm trying to enable exchange 2016 antispam, when i run cmdlet get-transportagent, below are the result, however there's spam email coming in to my mailbox..

Identity                                           Enabled         Priority
--------                                           -------         --------
Transport Rule Agent                               True            1
DLP Policy Agent                                   True            2
Retention Policy Agent                             True            3
Supervisory Review Agent                           True            4
Malware Agent                                      True            5
Text Messaging Routing Agent                       True            6
Text Messaging Delivery Agent                      True            7
System Probe Drop Smtp Agent                       True            8
System Probe Drop Routing Agent                    True            9
Content Filter Agent                               True            10
Sender Id Agent                                    True            11
Sender Filter Agent                                True            12
Recipient Filter Agent                             True            13
Protocol Analysis Agent                            True            14

When i run cmdlet get-contentfilterconfig | fl enabled, the result show FALSE
Does this mean i must get contentfilter agent to be activated, only the spam email will be rejected …

Is use DMARC and SPF to protect my domain, however a client recently became infected with malware and propogated the malware via spoofed email.  Now clients of mine are receiving mail addressed as me.  The question is how, what have I missed here.

Details
DMARC Record
v=DMARC1; p=none; rua=mailto:helpdesk@mydomain,mailto:7ffa0582@mxtoolbox.dmarc-report.com; ruf=mailto:My.name@mydomain,mailto:7ffa0582@forensics.dmarc-report.com; fo=1

SPF
v=spf1 +a +mx +ip4:M111.111.111.111 ~all
where

• IP is my public IP address
• MX is my cload spam filter provider.

We have dmarc implemented and I usually collect and review the reports weekly. About 3 weeks ago, the number of threat reports massively jumped and remains alarmingly high. Looking at a 2 month period: October-November, 7k emails passed dmarc, 70k have been reported as threats. This all looks like someone external has tried to use my domain and is failing the spf and dkim checks and I am getting the reports about it. I expect dmarc is working as it should but the volume of emails and the sudden increase around 3 weeks ago is what has got be concerned. Unfortunately I have had no reports from humans in that time of fake email coming from my domain. I do not even know the content of the emails or the recipients. All I know from dmarc is that they exist. My dmarc policy is set to quarantine rather than reject so conceivably people are still seeing the emails. I would appreciate any advice from the email experts here.

Hi expert,

In our environment, we have exchange 2016 with symantec messaging gateway (SMG)

Since we have the symantec messaging gateway, we thought of turning off the antispam feature in SMG but keep the antimalware feature.

How can i verify if my exchange has antispam turned off completely?

When i run get-transportagent cmdlet in exchange cmdlet, below is the result, is the spam enabled?

Identity                                           Enabled         Priority
--------                                           -------         --------
Transport Rule Agent                               True            1
DLP Policy Agent                                   True            2
Retention Policy Agent                             True            3
Supervisory Review Agent                           True            4
Malware Agent                                      True            5
Text Messaging Routing Agent                       True            6
Text Messaging Delivery Agent                      True            7
System Probe Drop Smtp Agent                       True            8
System Probe Drop Routing Agent                    True            9

I am using hotmail, if I ever marked any email as Junk or Phishing or clicked Block, will hotmail automatically inform the sender’s server about I marked their emails as spam? I recently noted that a genuine sender said I marked their emails as spam previously (which I did not recall I did), and they stop delivering any emails to me now until they reverse this situation from their servers.

I'm trying to configure a rule in Cisco CES cloud platform the stops people masquerading as the CEO
for attempted Phishing. So on our previous FW we had if the mail has the sender as 'our ceo' but does not come from
our Domain, then drop. I can see where to configure this in the CES.

hello,
I would like to know if it is possible to find an open smtp relay in internet that i can use with telnet to test if there are any issues with our antispam hardware.
thank you in advance

Yesterday I got an interesting SPAM that looked very much like the scam you see here.

I right clicked on the shortcut and copied it to the clipboard then pasted it into chrome on my test machine.  It takes me to what appears to be a legit bankofamerica website.  I have attached a screenshot.  I did not enter my passwords, but it sure looks 100% legit to me.

Here is the url:  https:/ / billpay-ui.bankofamerica.com/ imm/ PaymentCenter/ Index/ 8404?csbi=644077671&b0=20190916192841396056
I have added a space after each / to make it safe.


I've been told that some legitimate looking URL's will automatically redirect me to a bogus website, but how does that work? If the domain controller does the redirecting wouldn't bankofamerica.com avoid a bogus address? Or does the redirecting occur on the routers that the packets hop through?

In other words how can this particular link get me in trouble?
ee-bankofamerica.png

we have a single windows sbs2011 running exchange and windows 10 pro clients running outlook2007.

everything was running ok, but today, for some reason, for certain email contacts (not all), we receive a bounce back stating :-

No SMTP server defined. Use real server address instead of 127.0.0.1 in your account

I did research this and noticed an article relating to avast cloudcare, so we disabled the core shields on both the client and mail server, along with our vamsoft ORF antispam, but we still get the same error.

Can anyone advise how we go about resolving this?

Any advice much appreciated.

Thanks.

We are setting up SPF, DKIM, and DMARC for our domains but just wanted to get some clarification on the best options to set for each scan result:
none, neutral, softfail, hardfail, permerror, temperror

So basically wanting to know which is the best option?
From reading it seems that HardFail would be the way to go but just wanted some insight for these settings and what is the best practice for them to set them up?

How can I block countries from spamming my hotmail account?
I'm getting crap from the .CO domain and just want to shut that down completely.

ALSO, I keep getting crap from techstargroup.com but their emails are  prefaced with abc.techstargroup.com and ccs.techstargroup.com
Is there a wildcard I can use in hotmail's junk settings?
I placed their domain on the block list but they're still getting through.

Hey guys,

What is a good spam filter software (not service)?  I have a client who would like to install spam filter software on few computers.  Thanks in advance.