Hi:

I've cfg. an Exchange server to use IP Block List Provider zen.spamhaus.org but mail from IPs on the SBLCSS are still getting through.  From command prompt I've run nslookup x.x.x.x.zen.spamhaus.org and received proper 127.0.0.3 response so I know server can query Zen.  It's cfg. to 'Match any return code.'

Any ideas?

Thank you!

Hello,

Have you seen any results for the cmdlet (Run from C:\Program Files\Microsoft\Exchange Server\V15\scripts>.)

Get-AntispamTopRBLProviders.ps1

Ideally, you should get the result after 2-3 days of configuring the spamhaus agent connection filtering.

FYI, the following cmdlet can configure the agent (hope you did the same already)

Add-IPBlockListProvider -Name Spamhaus -LookupDomain zen.spamhaus.org -AnyMatch $true -Enabled $true -RejectionResponse "IP address is listed by Spamhaus"

Hi Herman,

I have searched some related information as below:

The Connection Filter agent examines the real-time block lists of any IP Block List providers that you've configured. If the sending server's IP address is found on a real-time block list, the message is rejected, and no other filters are applied.

More information for your reference:

https://technet.microsoft.com/en-us/library/aa997242.aspx

https://technet.microsoft.com/en-us/library/bb124320(v=exchg.150).aspx

 

Thanks

While we can mark this as the answer to determining/verifying that a block list is indeed being queried/used by the Exchange Server, I think the conclusion to this case is that IPs on the CSS component of the SBL are very time sensitive, i.e. the sending IP was not on the CSS list at the time the spam was sent, but by the time I as the admin research the issue, perhaps a day later, the IP is on the CSS.  Then 3 days later IPs are automatically removed from CSS if they're no longer sending spam.