Wednesday, January 1, 2003

Using Exchange Server to block spam

THIS WEEK'S POWERTIP

By Diane Poremsky

Before we begin this week's tip, I recently mentioned the new holiday file Microsoft released, which included holidays for 2003-2007. It's been reported that there are at least two errors in the file, one for Hanukah and Independence Day. How many can you find? Write to me at outlook@cdolive.com, if you are using the new holiday file and find these or additional errors.

This week's tip is for Exchange Server administrators. If you aren't an admin but still get too much spam on your Exchange account, you might want to forward this tip to your administrator.

Exchange Server includes just one spam fighting feature: Filter. It's not as good as a content filter, since it only filters on the sender's addresses and only stops spam from known spammer domains, but for those companies without a content filter, it can reduce the amount of spam the users receive and costs nothing to implement.

In Exchange 2000, Filter is located in Global properties, right click on Message Delivery. In Exchange 5.5, it's at Connections | Internet Mail Service properties | Connections tab. Both versions allow you to archive messages, but archiving requires a lot of disk space if you get a lot of spam.

Both servers have the option to filter blank senders, this is not recommended, since read receipts often have blank sender fields. You can filter without notifying the sender that you are filtering, which is recommended to reduce server load. Some of the spammer domains use NDRs (Non-Delivery Receipts) to remove names from their mailing lists, others may decide NDRs indicate filtering on their domain name so they switch to a new domain. In one test I did, approximately one-third of all NDRs were returned as undeliverable, which generated more traffic on my server.

Filtering works by comparing the senders email address to your list of domains you don't want mail from.. The filter accepts several different formats, including the full email address, cpo@edirect.com or @mailbox.com. It accepts wild cards, so you can filter on partial addresses, like deal@* and @*superdeal*. Exchange seems to have a limit of about 1500 items in the list, so the ability to use wild cards is important and done properly, can greatly reduce the amount of spam you get, without blocking mail you want.

You can use two wild cards, for example @*dailydeal* works, but three wildcards as in @*dailydeal*.* won't work. When you add @*dailydeal* to the filter, it will filter all mail from any domain containing dailydeal in the domain name, including @mydailydeal.com, @opt4546.mydailydeal.net, @dailydeal.spammer.com, etc. Wildcards are a good way to filter out casino, gamble and gambling domains, and I'm tempted to add filters for @*deal*, @*daily* and @*optin*, but I worry that a legitimate domain might use one of those words in their name.