Re: Spam showing SCL as -1

Tech-Archive recommends: Fix windows errors by optimizing your registry

firstly thank you all for you help. think i found out why it was coming
though as -1

the spam had multiple recprients one of which was on the white list. the
mail was coming though imf, it was seeing the whitelisted name so allowing
it though and then sending it to all the mailboxes.

so guess to catch this spam i would have to implement some spam filtering
past where the mail gets divided for the indvidual mailboxes.

many thanks again

Rob


"Alexander Zammit" <alex@respond_to_group> wrote in message
news:%23rVO3T6QHHA.1180@xxxxxxxxxxxxxxxxxxxxxxx
Let me correct my previous posting. It is normal to get SCL -1 for
internal email.

From what I gathered your problem can be summarized as follows:
1. You are receving spam with an SCL of -1
2. Authenticated connection are disabled.

This is not normal.
Are you using any third party extensions that integrated with IMF and
might be modifying its default behaviour?

If the answer is NO then you should really recheck everything that we said
in this thread.
If you confirm everything than this sounds like a case for MS Product
Support.

--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"snuzzleflange" <snuzzleflang@xxxxxxxxxxxxxxxxx> wrote in message
news:OG4%23Hu5QHHA.4476@xxxxxxxxxxxxxxxxxxxxxxx
So if imf is supposed to be checking authenicated connections messages.
it would not check internal mail still?
sorry if im being dense

we do not need authenicated connections (no one uses pop/imap etc) and so
exchange was already set up as explain in your article.

this is annoying me now.

if a mail (for example spam) comes in that has multiple receprients and
one of those is on the white list, im assuming the others it is addressed
to, will have the mail processed by imf and the person on the white list
wont?

Rob


"Alexander Zammit" <alex@respond_to_group> wrote in message
news:eRLFlvVQHHA.1908@xxxxxxxxxxxxxxxxxxxxxxx
Emails will be reated as -1 if these are being sent over an
authenticated connection.
I don't understand why the registry tweak is not working.

Do you need to allow authenticated connections?
Is anyone accessing emails using IMAP/POP3?

If no you should try disabling authenticated connections.
See tha last part of this article for details:
http://www.exchangeinbox.com:80/articles/034/openrelay.htm

Following that check if anymore spam get rated -1.

Between note that it is normal for internal email to be rated as -1.
However spam should be coming from outside... :)


--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"snuzzleflange" <snuzzleflang@xxxxxxxxxxxxxxxxx> wrote in message
news:e%234$6xUQHHA.2172@xxxxxxxxxxxxxxxxxxxxxxx
restarted IIS. still seems to be the same
outlook connects to exchange by connecting to exchnage server

SCL rating im seeing with the hack in outlook to see it as a column. I
know its working becuase outside mail i see as normal numbers like 1-5

Rob


"Alexander Zammit" <alex@respond_to_group> wrote in message
news:OY41RFUQHHA.4844@xxxxxxxxxxxxxxxxxxxxxxx
1. Try restarting IIS Admin service to make sure the registry change
is applied.

2. How are the email clients connecting to Exchange? As SMTP/POP3?
Outlook emails in a single server setup would not flow through IMF
normally.

3. How are you seeing these SCL ratings?

--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"snuzzleflange" <snuzzleflang@xxxxxxxxxxxxxxxxx> wrote in message
news:Oc056wTQHHA.4088@xxxxxxxxxxxxxxxxxxxxxxx
its one mailserver connected though a firewall to the outside world.
using an SMTP connection. outlook clients connect.

I have put the change in the registry for
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ContentFilter
CheckAuthSessions=1

not sure if this is working though as messages i send to someone else
in the office still shows -1 (is this right?)

and spam is still coming though as -1. So either authenicated
checking is not working or that wasnt the answer.

thanks for the help

Rob






"Alexander Zammit" <alex@respond_to_group> wrote in message
news:OLRH2XLQHHA.4412@xxxxxxxxxxxxxxxxxxxxxxx
give me more info on your exchange organization.
how many exchange servers do you have?
how are these networked?

You should also try enabling scanning of authenticated connections
for a test, as neo already advised.


--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"snuzzleflange" <snuzzleflang@xxxxxxxxxxxxxxxxx> wrote in message
news:%23KdOeyIQHHA.1252@xxxxxxxxxxxxxxxxxxxxxxx
yes it is.

checked and it isnt relaying

"Alexander Zammit" <alex@respond_to_group> wrote in message
news:ezHj9AIQHHA.992@xxxxxxxxxxxxxxxxxxxxxxx
Is the Exchange machine running IMF receiving emails directly from
the internet?

--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"snuzzleflange" <snuzzleflang@xxxxxxxxxxxxxxxxx> wrote in message
news:OLOKlaHQHHA.1756@xxxxxxxxxxxxxxxxxxxxxxx
Sorry im fairly new to this. How would an smtp session be
authenicated?

Many thanks for the help

"neo [mvp outlook]" <neo@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:e2dUoWHQHHA.1552@xxxxxxxxxxxxxxxxxxxxxxx
-1 means the message was submitted via an authenticated smtp
session.

"snuzzleflange" <snuzzleflang@xxxxxxxxxxxxxxxxx> wrote in
message news:O6Tc4KHQHHA.1252@xxxxxxxxxxxxxxxxxxxxxxx
We are getting spam coming though IMF as -1 SCL rating. and i
cant figure out why. we have a couple of users that are in the
whitelist and a couple of subjects. but none of these appear in
the spam.

Is there anyway of finding out exactly why this is happening
and how i can stop it?

Thank for any help

Rob

























.

Relevant Pages

  • Re: Spam showing SCL as -1
    ... So if imf is supposed to be checking authenicated connections messages. ... If no you should try disabling authenticated connections. ... Following that check if anymore spam get rated -1. ... IMF Tune - Unleash the Full Intelligent Message Filter Power ...
    (microsoft.public.exchange.admin)
  • Re: Spam showing SCL as -1
    ... IMF Tune - Unleash the Full Intelligent Message Filter Power ... If no you should try disabling authenticated connections. ... the internet? ...
    (microsoft.public.exchange.admin)
  • Re: Junk E-mail
    ... for the spam or we use IMF Tune to do the custom-header-to-SCL mapping? ... IMF Tune - Unleash the Full Intelligent Message Filter Power ...
    (microsoft.public.exchange.admin)
  • Re: WSUS - Outlook 2003 Spam filter Update
    ... IMF Tune - Unleash the Full Intelligent Message Filter Power ... I wonder if it would be a good solution to filter spam having WSUS ...
    (microsoft.public.windows.server.sbs)
  • RE: Spam filtering in exchange
    ... If I am in the server management ... >> I understand that you want to know how to enable Spam Filter on Exchange ... >> Exchange Intelligent Message Filter at: ...
    (microsoft.public.windows.server.sbs)