IMF Tune Opens Exchange to Any Anti-Spam Filter
September 23, 2005
10th July 2007 Update - Include updates for configuration steps in IMF Tune v3.0.
Download as PDF Document
IMF Tune enables any anti-spam filter to integrate into Exchange 2003. Filters running on any platform, on firewall appliances, and even at external service providers, suddenly become an integral part of Exchange.
The same level of integration offered by the Intelligent Message Filter is achievable with the help of IMF Tune. Spam is routed to the Junk Email folder at the client mailbox. Outlook Safe Senders, Safe Recipients and Blocked Senders are also applied.
The overall system setup is illustrated above. Emails are first processed by the anti-spam filter. This adds its "spaminess" classification and forwards them to Exchange. Here both IMF and IMF Tune are installed. IMF Tune extracts the filtering result and converts it to a Spam Confidence Level (SCL). Exchange now correctly recognizes the spam classification. Emails can thus be routed to the Inbox or Junk Email folder accordingly.
System Configuration
Here are the basic configuration steps:
Route inbound emails to the anti-spam filtering solution.
Configure the anti-spam filter to analyze emails and tag them with the filtering result. Different solutions may offer differing email tagging mechanisms. We will look into these in a moment.
Set the anti-spam filter to forward emails to the Exchange server.
On Exchange install IMF and IMF Tune. Follow the Exchange Configuration section to setup these components.
Email Tagging Formats
The anti-spam solution must publish its email classification through some tagging mechanism. Most filters support the insertion of custom headers or editing the email subject for this purpose.
Most commonly a flag may be set through a custom header. For example the following could be inserted whenever an email is classified to be spam:
X-SPAM: Yes
Legitimate emails would either have no header, or have the header value set to 'No'.
A more complicated scenario is when the filter adopts a broader range of values rather than a Yes/No flag. For example a percentage rating is sometimes specified.
Another fairly common case is the insertion of tags within the email subject. Typically this is composed entirely (or in-part) of some fixed text. Through this text it is then possible to extract the filtering outcome.
Exchange Configuration
On the Exchange Server both IMF and IMF Tune must be installed. Follow these steps to configure IMF.
Up to Exchange 2003 SP1, IMF is available as a separate install from the Microsoft download centre. Exchange SP2 includes IMF within it, eliminating the need for this step.
From the Exchange System Manager open the Message Delivery properties under Global Settings.
Select the Intelligent Message Filtering property sheet and configure it as follows:
| Gateway Action | No Action |
| Gateway Blocking Threshold | 9 (not relevant) |
| Store Junk Email Threshold | 6 |
Note that here we are focusing on the integration of an external anti-spam filter. Thus we go for a simple IMF setup by disabling Gateway Blocking.
Enable IMF.
In Exchange 2003 SP1 and earlier this is done from: <Organization> | Servers | <Exchange Server> | Protocols | SMTP | Intelligent Message Filtering. Here set the checkbox for the SMTP Virtual server receiving emails from the anti-spam filter.
Otherwise as from SP2 enablement is done from: <Organization> | Servers | <Exchange Server> | Protocols | SMTP | SMTP Virtual Server | General | Advanced. From here set the 'Apply Intelligent Message Filter' checkbox.
It is now wise to test IMF and make sure it works correctly. Leave the system running for some time. Spam should start being deposited to the Junk Email folder at the recipient mailboxes.
Note: The IMF Junk Email threshold was set to a relatively high value. Thus a fair amount of spam will still be delivered to the Inbox at this stage.
Note: If email is not delivered to the Junk Email folder, check that this functionality is enabled at the client mailbox. Refer to the IMF Tune FAQs for details on how to do this.
IMF Tune Configuration
Download IMF Tune from the WinDeveloper site at: http://www.windeveloper.com/imftune/downimftune.htm
Install the application on the same Exchange server running IMF.
From the IMF Tune configuration General category, set the 'Enable IMF Tune' checkbox.
Configure the IMF Tune action for SCL rating 7 and higher to 'Accept' as shown above. If you followed this whitepaper to the letter, this should already be the case. Otherwise, select the list entries and click on Edit to change the action setting.
Next select the SCL Rules | Simple category and set the 'Apply simple SCL Rules' checkbox.
You may now want to delete all the pre-configured SCL Rules that the installation creates for demonstration purposes. Do this by selecting the list entries and hit the delete button.
Click on the Add button to create a new SCL Rule.
-
Rule configuration depends on the type of tagging adopted by the anti-spam filter. Considering the Yes/No flag discussed earlier, we could configure two rules as follow:
| Header Name | X-SPAM |
| Matching Type | contains |
| Header Value | yes |
| Operation Type | set value to |
| SCL Value | 7 |
The second rule would match X-SPAM header value "no". In this manner legitimate emails are forced to the inbox:
| Header Name | X-SPAM |
| Matching Type | contains |
| Header Value | no |
| Operation Type | set value to |
| SCL Value | 0 |
Some anti-spam filters only tag spam emails. Legitimate emails can then be identified by the absence of a header. In this case we could configure a rule that matches a missing header. Here is an example of how the configuration would look like:
| Header Name | X-SPAM |
| Matching Type | Is empty/missing |
| Header Value | |
| Operation Type | set value to |
| SCL Value | 0 |
Let's instead consider subject tagging. If the filter identifies spam by inserting the text: '[SPAM]' the settings become:
| Header Name | Subject |
| Matching Type | Contains |
| Header Value | [SPAM] |
| Operation Type | set value to |
| SCL Value | 7 |
Save Changes and test the complete system.
Through IMF Tune you may also cater for more complex tagging scenarios. If the filter produces a range of value tags, multiple SCL Rules could be created. We could also make use of Advanced Rules where multiple conditions and exceptions can be combined in order to match the tags as necessary.
Finally if you need assistance with configuring the rules contact WinDeveloper support on support@windeveloper.com.
Final Tips
Filtering spam to the Junk Email folder enables users to maintain focus on their Inbox. Emails still reach their destination but the final separation minimizes the disruption caused by spam.
Users through Outlook may further customize filtering. Safe Senders, Safe Recipients and Blocked Senders may be specified from Tools | Options | Preferences | Junk E-mail.
All the client-side functionality is available through Outlook/OWA. No client-side extensions or custom rules are involved. Thus deployment is centralized and involves minimal disruptions.
All product and company names herein may be trademarks of their respective owners.
