|
How does IMF Tune help to quickly verify emails at the junk email folder?
IMF Tune enables the insertion of SCL ratings into the email subject. This is inserted as a prefix in the format (SCL: x). Thus at the junk email folder one can easily sort all emails by SCL rating. Since false positives are most likely to happen with the lowest SCL rating, sorting enables verification of these emails first. Read Complete Article...
back to index
How do I configure emails to be deposited to the junk email folder?
IMF Tune does not change anything in the way emails are moved to the junk email folder. Hence this is purely a matter of configuring the Exchange Intelligent Message Filter and the email clients. Read Complete Article...
back to index
Why aren't emails ending in the junk email folder?
For emails to be deposited to the junk email folder rather than the inbox you need to make sure that this functionality is enabled at the client mailbox. But before doing this make sure that IMF is also correctly configured at the Exchange System Manager. See more details from: How do I configure emails to be deposited to the junk email folder?
If you already verified the Exchange System Manger settings, then check that the junk email folder is enabled at the client mailbox. This can be done either through OWA or through scripting. Read Complete Article...
back to index
Why isn't IMF Tune processing any emails?
You need to make sure that IMF is enabled at the Exchange System Manger and also that IMF Tune is enabled at the configuration. Read Complete Article...
back to index
How do I force an email to go to the Junk Email Folder?
Typically you need to do this when spam still manages to reach the recipient Inbox. Read Complete Article...
back to index
How do I configure IMF Tune to only insert the SCL rating in emails ending in the junk email folder?
Read Complete Article...
back to index
How do I use IMF Tune to improve the SCL threshold configuration?
Optimizing SCL threshold configuration typically aims to
To get the best out of IMF we need to monitor how a set of configuration settings is performing. IMF Tune helps in this task in the following ways:
Insertion of SCLs in the email subject and email headers exposes the SCL rating for individual emails. Thus one can immediately tell what the SCL rating was in case of a false result. IMF Tune enables the setup of SCL based logging. This provides a CSV formatted file in which each email is listed together with its SCL rating and other key information. This simplifies looking up the list of emails processed and type of actions applied.
back to index
How do I separate email archives/logs based on SCL ratings?
At IMF Tune create multiple SCL configurations. One for each of the SCL ranges requiring independent logging/archiving. In this manner you can setup a unique log file/archive directory for each of the SCL ranges.
back to index
Why should I set the IMF Gateway action at the Exchange System Manager to No Action?
IMF Tune only processes email after that the Exchange Intelligent Message Filter finishes its processing. Any emails blocked by the IMF Gateway Blocking are not processed by IMF Tune. IMF Tune can perform all the Gateway Actions itself plus that it gives a lot more functionality. Hence the correct setup is that to set the Gateway Action to No Action and configure any of the Archive, Delete or Reject actions at the IMF Tune configuration.
back to index
How do I get exactly the same functionality from IMF Tune when setting Gateway Blocking to No Action?
Gateway Blocking provides the ability to setup Archive, Delete and Reject actions. This is how IMF Tune can be configured to achieve the same functionality. Read Complete Article...
back to index
The Intelligent Message Filter has an Archiving Action. Where is this in IMF Tune?
The Exchange Intelligent Message Filter Gateway Blocking includes an Archiving Action. This is effectively a Delete and Archive operation since archived emails are not delivered.
IMF Tune does not list Archiving in its Action list but rather makes archiving always available independently of which action is performed. Thus archiving is possible whether you Accept, Reroute, Delete or Reject emails. For more details refer to: How do I get exactly the same functionality from IMF Tune when setting Gateway Blocking to No Action?
back to index
How do the IMF Gateway Archive, Delete or Reject actions compare to IMF Tune actions?
Firstly note that when using IMF in combination with IMF Tune, the recommended setup is to set the IMF Gateway action to No Action. For more details check: Why should I set the IMF Gateway action at the Exchange System Manager to No Action?
For details on how to configure IMF Tune to achieve a direct equivalent configuration to Gateway Blocking check: How do I get exactly the same functionality from IMF Tune when setting Gateway Blocking to No Action?
IMF Tune provides additional functionality over the basic Gateway Blocking. This includes:
Disk archiving is always available not just when performing a Delete and Archive operation. Details of blocked emails may be recorded in CSV formatted log files. Thus simplifying tracking down deleted/rejected emails. Even in case of deletion/rejection auto-reply emails may be generated. Rather than archiving to disk IMF Tune enables archiving to the information store through the Reroute action, thus retaining all emails in their most appropriate repository i.e. the Information Store. Multiple blocking thresholds may be configured. Each of these may have differing logging, auto-reply and archiving configurations.
back to index
How does IMF Tune help me to reduce spam at source?
Through the detailed logging information generated by IMF Tune it is possible to identify some common spam sources. For example the originating host IP can be useful in setting up IP blacklists.
This information could also be processed through one of the many reporting tools available on the market. All of these typically support the CSV format generated by IMF Tune. Hence you should be able to import the data directly and then generate reports based on the capabilities of the tool used.
In this case it is best to generate separate log files for the higher range of SCL values where the likeliness of false positives is minimal.
back to index
Should I use IMF Tune Blacklists or Exchange Deny Lists?
The IMF Tune Sender and Recipient Blacklists work differently from the Exchange Sender and Recipient Filtering lists. Thus, which of the two is most appropriate depends on the type of functionality required.
Exchange Sender Filtering is done immediately on receiving the SMTP MAIL FROM command. This gives the opportunity to terminate email delivery immediately minimizing the impact of spam. Likewise Exchange Recipient Filtering is done immediately on receiving the SMTP RCPT TO command. Again recipients may be immediately rejected.
IMF Tune analyzes the emails at a later stage. It is still able to reject emails at SMTP protocol level but more data would have been exchanged between the sending and receiving ends. Thus Exchange Filtering has the advantage of minimizing waste in resources due to spam.
On the other hand IMF Tune offers extra functionality that is not available through Exchange Filtering. This includes rerouting to a central mailbox, deletion, logging, archiving etc. These features are also available to blacklisted emails when this is done through the IMF Tune Blacklists.
Furthermore IMF Tune enables more consistent handling of spam. The Exchange Filtering functionality is not integrated with IMF. For example Exchange Sender Filtering does provide the ability to archive emails, but in turn this is not consistent with the IMF email archiving. IMF Tune provides a consistent interface through its SCL based email handling configuration.
Another important difference is the fact that Exchange Sender and Recipient Filtering are performed even for emails originating from hosts whose IP is on the IP Accept list. IMF Tune gives whitelisting higher priority over blacklisting. Thus in case of IMF Tune an email matching both a whitelisting and a blacklisting condition is classified as whitelisted. Hence in this case one has to see what type of behavior is required.
back to index
Does IMF Tune process emails rejected through the Exchange 2003 Connection, Sender or Recipient filtering?
No. Emails rejected through Exchange 2003 filtering never reach IMF Tune. Hence the blacklisting configuration at IMF Tune does not apply to these emails.
For more details check the FAQ Should I use IMF Tune Blacklists or Exchange Deny Lists?
back to index
I have IPs configured at the Exchange Connection Filtering IP Accept list. How will IMF Tune handle emails matching this list?
IMF Tune will handle these as whitelisted. It will apply any email handling settings as configured for whitelisted emails.
back to index
At IMF Tune I can configure email handling for "unprocessed" emails. Which emails fall in this category?
IMF Tune couples tightly with the Exchange Intelligent Message Filter. Hence which emails are processed or left unprocessed is determined by the Exchange IMF and not IMF Tune.
By default IMF won't process emails from an authenticated connection. Thus these are handled as unprocessed by IMF Tune.
Another scenario giving rise to unprocessed emails is when IMF is not enabled for some (or all) SMTP Virtual Servers. In this case emails delivered by these Virtual Servers will be classified as unprocessed.
back to index
What is SCL 999?
999 is the SCL value assigned by IMF Tune to blacklisted emails. At the moment Exchange IMF does not define an SCL for blacklisting. Thus we had to invent one. We chose a value that is much larger than the largest defined SCL. For this reason, whenever choosing to expose the SCL value, 999 will be set in case of blacklisted emails.
back to index
I configured various Whitelists, Blacklists and SCL Rules. What happens if an email causes multiple matches?
With Whitelisting, Blacklisting and SCL Rules it is possible for a single email to give rise to multiple matches. IMF Tune follows a "play safe" rule. When multiple conditions match, the lowest SCL rating is applied. For example if an email contains a keyword located in a blacklist and a keyword located in a whitelist than the email is whitelisted.
Extending this concept further, if an email matches an SCL Rule configured to set the SCL to 5 and also matches a keyword located in a blacklist, than the final SCL will be 5.
SCL Rules applying 'increment by 'and 'decrement by' operations are considered to have the lowest priority. The increments and decrements are only computed if no other match is found that would set the email to a fixed SCL value. If computed, increments and decrements add up so that the final SCL value is the net result.
So to recap, the final SCL rating is assigned based on these priority rules:
Whitelisting has highest priority. An email may be whitelisted through:
Next in priority are the SCL Rules having the lowest 'set value to' SCL value. -
Next in priority is Blacklisting. An email may be blacklisted through:
IMF Tune Blacklists. SCL Rules.
Lowest in priorities are the SCL Rules having an 'increment by' or 'decrement by' SCL operation.
back to index
The IMF Tune machine receives emails relayed by another server. Can we still filter emails by IP?
In this case you may want to consider setting up an SCL Rule for the RFC2822 Received header. For example consider the IP 127.0.0.2. Let's say you want all emails originating from this IP to be deposited to the Junk Email folder or to be blacklisted.
In this case you can setup a mapping specifying that if the Received header contains 127.0.0.2 the SCL is set to 5. Here 5 is an SCL value for which emails are configured to be deposited to the Junk Email folder.
For more details on how to setup IMF Tune refer to the FAQ How do I force an email to go to the Junk Email Folder?
For more details on the RFC2822 Received header refer to: http://www.faqs.org/rfcs/rfc2822.html
back to index
Why are the settings at the IMF Tune configuration under the Exchange System Manager category read only?
These settings apply to functionality provided either by Exchange itself or by the Intelligent Message Filter. This is done to provide a centralized view of all settings relevant to anti-spam protection and to increase the awareness of the Exchange out-of-the-box anti-spam functionality. Thus any modifications should be done through the standard Exchange management console.
back to index
How do I contact technical support for questions not answered in this FAQ?
Email to: support@windeveloper.com
back to index
| 
