IMF Tune v6.1 - Forefront Protection 2010 for Exchange Support
What's New in IMF Tune v5.6
Version 5.6 is now available for download! Get started with the latest release and checkout the new Sender Auto-Whitelisting functionality.
IMF Tune will now automatically discover the foreign contacts your users are exchanging emails with. Subsequent emails are automatically whitelisted relieving you from having to manually maintain whitelists.
To get started, just set the Enable Sender Auto-Whitelisting checkbox. Within a few days, a significant number of legitimate emails will be immediately whitelisted bypassing any further filtering. Once the initial discovery is completed, the only legitimate emails undergoing spam filtering will be those from new contacts.
Whitelisting a large proportion of legitimate emails significantly reduces the likeliness of false classification. In turn, this gives us the opportunity to filter spam more aggressively. In other words we are able to lower our filtering thresholds and trap more spam.
Our recommendation is that to let Auto-Whitelisting run for some days. Monitor the number of whitelist hits using Keyword Reporting or even better the Moderator/Reporting Web Interface. Both of these allow us to distinguish between Auto-Whitelist hits and Static-Whitelist hits (i.e. whitelist entries manually entered at the configuration interface). Once we confirm that many legitimate emails are being auto-whitelisted we can try lowering the SCL blocking threshold at the IMF Tune configuration Email Handling category.
Sender Auto-Whitelist Configuration
There are certainly other auto-whitelisting solutions on the market. However we believe our implementation stands out because we offer a lot of control over this functionality. Let's have a look at the configuration interface.
Here we find the new Auto-Whitelist Senders category.
Enable Sender Auto-Whitelisting activates the new functionality.
Limit List to nnnn addresses specifies the maximum size this list may reach.
Remove addresses from the whitelist after nnnn days allows IMF Tune to automatically purge addresses for contacts with whom no emails were exchanged for a long time.
You may choose to whitelist addresses for unlimited time. However in practice very often a contact is only required for a few days, such as the duration of a support incident. This feature restarts the day count for each address whenever a new email exchange takes place. In this manner regular contacts are never removed from the list.
Gather foreign addresses from emails sent by, allows us to identify the list of local users whose contacts are to be gathered for whitelisting. We can choose to simply enable this for all users using 'Any local domain user'. Otherwise we can choose to specify a list of users to exclude or include in the discovery process.
As an example, imagine you have some guest using your email services for a short while. You might not want to whitelist contacts for such guests. As another example, consider the case where you have a mailbox that sends out automated emails to anyone filling some web form. You may choose not to auto-whitelist foreign contacts interacting with this mailbox.
Under the Auto-Whitelist Senders category we find the Exceptions list.
Here we enter email addresses that IMF Tune should never auto-whitelist. Consider the case where some local user starts an email exchange with a malicious sender, or the case where some contact turns out to be a pest. You can instruct IMF Tune to stop auto-whitelisting the sender by entering his address here.
Here you can also enter entire domains using the *@domain format. This instructs IMF Tune not to whitelist any address from this domain. For example users might be using their work mailbox both for business and personal use. Some domains providing personal email addresses might be irrelevant to your Organization business. That's when this list again comes handy.
Note that the Auto-Whitelist Exception list is not a Blacklist. Specifying an address or domain here will only exclude the address from being auto-whitelisted. Emails from these senders will still be processed and might match other static whitelists, blacklists and rules.
In version 5.6 we also updated the Keyword Reporting and Moderator/Reporting Web Interface to support Sender Auto-Whitelisting.
This is how a Sender Auto-Whitelist match looks like at the Server HTML Keyword Report:
Note how the header name is shown as Sender (AWL).
And this is how the same match is shown at the Moderator/Reporting Web Interface:
The Moderator/Reporting Web Interface will also identify Auto-Whitelist matches at the Keyword Performance report under Detailed Spam Detection Report. Here we can see a couple of addresses being matched:
IMF Tune v5.6 is a free update for all IMF Tune v5.5 users. If you are currently licensed to run IMF Tune v5.5, just upgrade to v5.6 using the same license key.
The IMF Tune v5.6 server can be installed directly on top of IMF Tune v5.x and v4.x installations. This allows the installation to convert all configuration settings automatically. Earlier IMF Tune versions can be upgraded by uninstalling the older release and installing version 5.6 to the same disk location. For a detailed discussion of all possible upgrading/migration scenarios please refer to Upgrading/Migrating to IMF Tune v5.6.
This information applies to IMF Tune v5.6 build number 5.6.012.27. If IMF Tune is already installed you can verify the current build number from the configuration.
In IMF Tune v3 and earlier the build number is available under the WinDeveloper category.
In IMF Tune v4 and later the build number is available under the Miscellaneous category.