[There's a reason that Yoda is the unofficial mascot of SBS. Size indeed matters not.] A little more spam filtering - THE OFFICIAL BLOG OF THE SBS "DIVA"
Sun, Aug 12 2007 9:04 bradley

A little more spam filtering

Les Connor uses spamhaus.org to add a bit more spam filtering to his clients

http://www.spamblogging.com/archives/000138.html

Go to the Connection filtering tab, and enter zen.spamhaus.org as the
provider, and OK/apply.

Ensure connection filtering is enabled in the default smtp virtual
server.

Go into the default SMTP Virtual Server Properties

Click on Advanced

Click on Edit and ensure Apply Connection Filter

 



Go to http://www.spamhaus.org/ and have a look at their faq's, they're very
good. The zen thing includes their 3 anti-spam databases.

You can set up perfmon counters to see how effective it is - see the
attachment. See below:  The IMF perfmon setup is there as well. I keep shortcuts to
the two on the server desktop so I can check the stats periodically.

 

When I did one of my Fast Track webcasts I did a demo of my Performance Monitor 
reports for Intelligent Message Filter and Real-time Black Lists reports. I thought I 
would show them here since everyone seemed pretter interested in them. To create 
these, you just bring up Performance monitor and pick the counters listed below, 
select view report on the toolbar and save it as a shortcut. The counters will reset 
when the machine is rebooted.

P.S. Oh yeah... Les says it appears to nail most of this pdf spam

Filed under:

# re: A little more spam filtering

Sunday, August 12, 2007 12:45 PM by Russ SBITS.Biz

In Addition:

I like to put a Custom Error Messsage, just in case it's a LEGIT Business that got rejected.

"The IP Address %0 was rejected by the RealTime Blocklist provider %2 Please call our office www.domain.com."

# re: A little more spam filtering

Sunday, August 12, 2007 3:20 PM by fatjoe

You can set up perfmon counters to see how effective it is - see the

attachment. --- Where's the attachment?

I presumed this would be straight forward but my performance monitor doesn't contain the shown counters.

# re: A little more spam filtering

Sunday, August 12, 2007 9:18 PM by Rich Lusk

Susan, you and Les don't mention any fees that are associated with this method.  Is there any?  I get the idea from their websites that there are fees but doesn't mention adding them to a Exchange Server.

Thanks.

# wehuberconsultingllc.com » Blog Archive » A little more spam filtering

Sunday, August 12, 2007 9:34 PM by wehuberconsultingllc.com » Blog Archive » A little more spam filtering

Pingback from  wehuberconsultingllc.com  » Blog Archive   » A little more spam filtering

# Pricing of Spamhaus

Monday, August 13, 2007 1:25 AM by E-Bitz - SBS MVP the Official Blog of the SBS "Diva"

Follow up to msmvps.com/.../a-little-more-spam-filtering.aspx Someone

# re: A little more spam filtering

Monday, August 13, 2007 6:22 AM by Chris Knight

There are two things I dislike about the Connection Filtering in Exchange.

The first is a lack of logging information. Performance counters are of no use when you're trying to diagnose a message delivery problem.

The second is the inability to change it from rejecting a connection to either adding a value to the spam score or to quarantining the message to a quarantine folder.

I find outright blocking to be more problem than it's worth. There's always a valid message that gets clobbered, and the perceived benefits of blocking don't outweigh the blocking of valid e-mails.

# re: A little more spam filtering

Monday, August 13, 2007 4:46 PM by Al Iverson

In reply to Chris's comments, I would say: Outright blocking certainly does have the potential side effect of clobbering valid messages, especially if one chooses poorly with regard to what blacklists to use. But, it's also a helpful thing so that people trying to send to you can be told that you're blocking their mail, instead of dumping it into a quarantine that might never be checked. In other words, it has the potential to help drive the reform of a blacklisted sender, which is what makes a blacklist like Spamhaus successful at what they do -- run afoul, get blacklisted, fix the practice, no longer run afoul, get unblacklisted, stay unblacklisted.

# re: A little more spam filtering

Monday, August 13, 2007 4:53 PM by Steve L

Are these stats in here back to when?  Since we installed exchange or the IMF filter?

Steve