IMF Tune v6.1 - Forefront Protection 2010 for Exchange Support
Extracting List of Auto-Whitelisted Addresses
ManageAWL, a little command-line tool for extracting the IMF Tune Sender Auto-Whitelist address list, is now available for download.
Sender Auto-Whitelisting (AWL) is a real time process that collects foreign addresses with which local users are exchanging emails. These addresses are moved to a whitelist so as further email exchanges are allowed to bypass filtering.
Some of you searched for the list of AWL addresses at the configuration sender whitelist. However this is not where we store these addresses. The configuration list is static, and can only be modified manually. With today's tool we want to start bridging this gap.
Installing and Using ManageAWL
To start using this tool, follow these steps:
Important: The help screen alerts us of an important limitation that is worth highlighting. ManageAWL is normally unable to show us the very latest addresses collected by the whitelisting process. Addresses may take up to 24 hours until these become visible. The reason for this has to do with making the process as efficient as possible. IMF Tune immediately starts applying newly discovered addresses for whitelisting, however it only renders the latest addresses visible in batches. Thus, even though some emails might start being whitelisted, ManageAWL may take some time until it catches up.
In this mode ManageAWL will produce a flat list of whitelisted addresses:
We can choose to dump the list to the command prompt using:
...or else we can redirect the output to a file using:
In this mode ManageAWL gives us a better insight of how AWL is working:
Again we can choose between dumping the information to the prompt or to a file:
Each address batch starts with the header area including:
The date shown by 'Addresses Added on' is used to implement the purging of old addresses. The relevant setting for this is available at the configuration under:
'Addresses Last Changed on' is also interesting. IMF Tune moves around addresses each time these are rediscovered. Whenever local users exchange new emails with a foreign contact, the foreign address is removed from the old batch and inserted in the latest address batch. In this manner, contacts with which local users are regularly exchanging emails never get purged.
ManageAWL is a Read Only Tool
ManageAWL only allows us to read the whitelist. It does not allow for deleting addresses. The reason for this is that deleting AWL entries is not all that useful.
Let' say we have an address we don't want to whitelist any longer. Removing the address from the AWL will stop IMF Tune from whitelisting it however it won't block the AWL process from re-discovering the same address. This is why the correct solution is to add any such addresses to the AWL Exception list under:
When adding an exception IMF Tune will:
This information applies to IMF Tune v5.6 build number 5.6.012.27. If IMF Tune is already installed you can verify the current build number from the configuration.
In IMF Tune v3 and earlier the build number is available under the WinDeveloper category.
In IMF Tune v4 and later the build number is available under the Miscellaneous category.
All product and company names herein may be trademarks of their respective owners.