Re: IMF and SCL values

The closest available thing is the Connection Filtering IP Accept List. If
the senders to be whitelisted have their emails coming from the same IPs,
then you could whitelist them like that. Otherwise you will need a thrid
party extension.

Since you are having many false postives, did you enable IMF updates? These
are very important for IMF to keep up with the latest spam. More details
from here:
http://www.exchangeinbox.com/articles/016/imfupdates.htm
http://www.exchangeinbox.com/articles/032/imfupdatetips.htm


--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"Vishal" <Vishal@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:76A508A0-AD93-42C2-AF42-5A6EA9D29617@xxxxxxxxxxxxxxxx
okay ... so we can not list domains which are defined as safe senders.

However if a user has been added as a safe sender in outlook ... is their
a
way to ensure the IMF doesnt not mistake their emails and treat that user
[who is sending as spam]??

Because, we have many false positives.

Thanks

"Alexander Zammit [MVP]" wrote:

IMF Gateway Filtering does not care about Safe Senders.
This changed in Exchange 2007...

--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"Vishal" <Vishal@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:85D25A03-2840-4E29-BC51-039CB2ED205A@xxxxxxxxxxxxxxxx
Hi,

That user was a safe sender. Why does IMF block from that user??





"Alexander Zammit [MVP]" wrote:

This is normal behaviour for Exchange 2003 IMF.

You are using the IMF Gateway Archive Action. IMF will archive the
email
regardless of your Outlook settings.

The safe-senders are only considered for emails that are not blocked
by
the
Gateway Action.


--
Alexander Zammit
WinDeveloper Software
IMF Tune - Unleash the Full Intelligent Message Filter Power
http://www.windeveloper.com/imftune/


"Vishal" <Vishal@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:4F3FD306-82FB-4ECD-B548-752B56FFB79B@xxxxxxxxxxxxxxxx
Hi,

You can see that ilimcater@xxxxxxxx is a safe user but IMF v2 still
blocks
[some] emails ...

http://www.box.net/shared/gua9upr0h8

http://www.box.net/shared/ep7kgz2nql


"Sanjay Mehta" wrote:

Hi,

I think we could address this problem in a slightly different way
...

Please see the screen shot at ...


http://www.box.net/shared/oj7c8ascgk


I have seen on IMF "Debbie Davis" caught twice by IMF ... is there
a
way
I
can add that sender as a safe sender on exchange so that IMF never
checks
for
that user ... regardless of having ALL users in an organisation to
have
that
particluar user as a safe sender.

Thanks

"Bharat Suneja" wrote:

Since Exchange Server 2003 SP2/IMF do not have the kind of
logging
seen
in
Exchange Server 2007, at times it's hard to pinpoint exactly why
without
looking at a lot of other information, some of which I outlined
in
the
previous post.

The other way to look at this is - can the problem be reproduced?
Are
messages from a particular domain/host IP address/sender with
particular
content getting the same treatment, or is it an isolated incident
that
cannot be reproduced?
--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
exchangepedia.com/blog
----------------------------------------------
"Vishal" <Vishal@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:104B25D9-8C40-439C-AA0C-D4200A7EE729@xxxxxxxxxxxxxxxx
Its IMF v2 and that is our only server.

I am refering to the screenshot ... the email is from an
external
users. 3
of his emails have SCL values, 1 doesn't.

why?

the one which doesnt have a SCL rating is caught as spam ...
and
also
the
user was added as a safe sender. Thus he should not be caught
by
IMF.

Thanks


"Vishal" wrote:

Hi,

Its IMF v2. Its not an internal message.

We have only one server and that has IMF enabled.


My question is about the ratings of SCL. For one message I
have
the
ratings,
for another I dont from the same user.

Thanks

"Bharat Suneja" wrote:

Mentioning the version of Exchange you're on helps - is this
Exchange
Server
2007 (Content Filter Agent) or Exchange Server 2003 SP2 (IMF
v2).

IMF does not scan a message if it's an interal message (from
an
Exchange
recipient, authenticated), over an authenticated SMTP
session,
if
it's
received from an IP address that's on the Global Accept List
in
Connection
Filtering (with Connection Filtering enabled), if the
message
is
received on
a SMTP virtual server/IP address that does not have IMF
enabled,
or if
the
message is over 3 Mb. in size.
--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
exchangepedia.com/blog
----------------------------------------------
"Vishal" <Vishal@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:460426DF-1CF0-49EE-B89F-3DDA34363DF2@xxxxxxxxxxxxxxxx

Hi,

I am trying to understand why IMF does not show be the
Spam
Confidence
Level
(SCL) for the SAME user.

For example, if you look at the user Philip Satim for the
first
3
emails
it
displays. The 4th email however it doesn't show.

http://www.box.net/shared/2417gq0e5g

And that was a legitiate email and my user A had added
Philip
Satim
as a
safe sender.

Thanks














.

Relevant Pages

  • Re: SMTP logging
    ... I bet it wouldn't be a problem with essentially any kind of internal monitoring report imaginable, with the exception of a spam report email, which will make IMF automatically apply an 8 to it and archive it if the IP is not on the right list in the right way. ... The various list combinations make my head hurt, but originally I didn't even have the Connection Filter (or Sender ID) enabled so had nothing in General, which only applies to those two. ... So then I investigated the problem and through that article found that it was the Accept List in Connection Filtering that allows you to make IMF host exceptions. ...
    (microsoft.public.windows.server.sbs)
  • Re: SMTP logging
    ... The various list combinations make my head hurt, but originally I didn't even have the Connection Filter (or Sender ID) enabled so had nothing in General, which only applies to those two. ... In that scenario, with just IMF enabled, IMF will hold a spam report every time. ... So then I investigated the problem and through that article found that it was the Accept List in Connection Filtering that allows you to make IMF host exceptions. ...
    (microsoft.public.windows.server.sbs)
  • Re: IMF blocks Blackberry Email
    ... Locate the emails from telus and rogers and add the sending server's IP ... Filtering on the SMTP virtual server. ... filters resides - including IMF, which was moved here from SP2/IMF v2. ...
    (microsoft.public.exchange.admin)
  • Re: SMTP logging
    ... I'll admit to being something less than an expert on this, but I don't see any reason why an internal IP would need to be on the Connection Filtering accept list. ... The way I'm interpreting all of this is that if an IP is on the list, that IP bypasses Connection and Sender ID filtering. ... That means the Sender ID status gets attached to the message for processing by the IMF - it just adds another bit of information for the IMF to consider. ... And do you have a reliable RBL to recommend? ...
    (microsoft.public.windows.server.sbs)
  • Re: Tracing lost emails after activiating IMF
    ... Connection Filtering ... IMF Tune - Unleash the Full Intelligent Message Filter Power ... IMF is trapping around 2500 emails per day. ...
    (microsoft.public.exchange.admin)