Anti-Spam features

Exchange Server 2007 provides an integrated, IP based block-and-allow list based on sender reputation. Lists are automatically updated as new versions become available. Administrators can establish additional IP allow-or-deny lists as needed.

Sender reputation is dynamically analyzed and updated. When the Edge Transport server spots specific trends from a given domain, it can impose certain actions to either quarantine or reject incoming messages. Sender ID is also used to verify that each e-mail message originates from the Internet domain from which it claims to come from based on the sender's SMTP server IP address. Once a Sender ID record has been verified, the results can be cross-referenced to past traffic patterns and sender reputation, creating an associate weight into the domain reputation. Finally, recipients are validated, and administrators have the ability to block messages sent to non-existent user accounts or internal-only distribution lists

Via EdgeSync, the Edge Transport server respects Outlook 2003 and Outlook 2007 safe sender lists to help reduce false positives.

Exchange Server 2007 embeds support for Sender ID, an e-mail industry initiative designed to verify that each e-mail message originates from the Internet domain from which it claims to come based on the sender's SMTP server IP address. Sender ID helps prevent domain spoofing and protect legitimate senders’ domain names and reputation and helps recipients more effectively identify and filter junk e-mail and phishing scams.

Content is analyzed using the Intelligent Message Filter (IMF), Exchange Server's implementation of Microsoft SmartScreen content filtering technology. SmartScreen is based on Microsoft Research's patented machine-learning technology. Anti-phishing capabilities are also built-in to the IMF to help detect fraudulent links or spoofed domains and protect users from these types of online scams. When used with Outlook 2007, a phishing warning or block appears in the user interface. Customers are protected from emerging spam attacks through the automatic filter updates for Exchange Server 2007, which are published on a frequent basis. Should the administrator require additional control, the Edge Transport server enables customization, including the ability to add words or phrases to the filter.

Exchange 2007 verifies Outlook E-mail Postmarks attached to messages sent from Outlook 2007. The Outlook E-mail Postmark can reduce false positives for messages from legitimate senders that have little to no reputation.

In addition to scanning message content, the IMF consolidates guidance from Connection, Sender/Recipient, Sender Reputation, Sender ID verification, and Outlook E-mail Postmark validation to apply a Spam Confidence Level (SCL) rating to a given message. Administrators can preconfigure actions on the message based on this SCL rating. Actions may include deliver to the inbox or junk mail folder, deliver to the spam quarantine, or reject outright and no deliver.

The Edge Transport server role controls the inbound SMTP message receipt rate for increased availability. This control, coupled with the ability to detect open proxy machines, can aid in preventing denial of service attacks. Tar pitting is supported to slow the server response for certain SMTP communication patterns, minimizing exposure to directory harvest attacks.

Messages filtered by the Edge Transport server role are stamped with information, including why the message was considered spam and which combination of filters and reputation services (IP, domain, sender, recipient, content) determined its spam assessment. Administrators may use this information in an aggregate way to understand the effectiveness of filtering across their multilayered approach and tune appropriately.

The Exchange Server 2007 environment enables two-tiered spam quarantine. First, administrators have access to a Spam Quarantine housed in the perimeter network. Using Outlook, administrators can access the Spam Quarantine to search for messages, release to the recipient, or reject and delete. Messages with borderline SCL ratings (borderline definition configured by the administrator) may be released to the end user's junk mail folder in Outlook, and are converted to plain text for further protection.

Management of the Edge Transport Server role and corresponding rules is consistent with the rest of the Exchange environment and can be performed using the Exchange Management Console graphical interface or the Exchange Management Shell for automation. Finally, the administrator can leverage notifications through Microsoft Operations Manager (MOM) or reports within Exchange to analyze the effectiveness of their anti-spam filters.