HiRecently we configured Cisco Ironport for receiving and sending mails using connectors from Exchange 2003 FE serversWe need help to configure & fine tune Exchange on below topics1) Is it required to mention all Cisco Ironport appliance IPs inPerimeter and internal IP Range Configuration (Message Delivery - Properties- General2) We configured IMF on both FE servers to updatefromMicrosoft updates through Registry, but only on one serverwe can able to update, on the other server MS update not showing the IMF update3)We createdMSExchange.UceContentFilter.xml filewith entry <CustomWeightEntry Type="BOTH" Change="MAX" Text="Job Application Form" />. Our intention is to exclude those mails from our external hosted web site. But still IMF is blocking the mails and archiving it, it's showing SCL as 8.99. How can we exclude all such mails with subject as mentioned above. Also we excluded the sender domain throughconnection filtering exclusionsThanks in adavance RegardsLalServer Engineer

Answers are1. NO2. Is it on Sp2?3. Play around with SCL ratings and try to see, which one fits you better. All that you want on SCL http://www.petri.co.il/block_spam_with_exchange2003_imf.htmRaj

HiThanks for your updateAll the servers are running Windows 2003 SP2 & Exch SP2 If we change SCL ratings to 8 then most of spam mails will be delivered to users MBs (We can see the SCL ratings with each archieved mails , because we enabled to display SCL ratings with each archived mails)Can you tell me why those mails arearchived by IMF (SCL 7.9) even after we excluded those domains, mail-ids& even IPs, actually this e-mail is generating from our ownexternal job site.Ihave to resolve this issue soon.Also we enabled Recipient filter, Connection filter, IMFon SMTP VS.RegardsLalServer Engineer

Is it some kind of mass mailing to all the job applicants? As by default Mass mailing is considered as SPAM. Try to reduce the number of recipients in the email and try.Raj

HiIt's not a mass mailing, if some one access our site they can apply for job and that mail will be directed to one internal ID. Daily we receive max 2-5 such mails and it's getting blocked. But I think If we exclude sender id, and also through MSExchange.UceContentFilter.xml we exclude the subject, the mails should not be scanned by IMF. But why it's happening?RegardsLalServer Engineer

Hi,Did you want to prevent the "Job Application Form" from entering into the mailbox or allow this behaviour? Did you set the Archive option for the IMF when blocking the message if the SCL greater than or equal to 8?The custom weighting feature (MSExchange.UceContentFilter.xml)in Intelligent Message Filter for SP2 lets administrators customize the behavior of Intelligent Message Filter, based on phrases that are in the body of an e-mail message, the subject line, or both.In the Change parameter which can use the MIN or MAX keywords. Any time a phrase with the MIN keyword is matched, the message is given an SCL of 0 regardless of any other weights. Any time a phrase with the MAX keyword is matched, the message is given an SCL of 9 regardless of any other weights. Any time there is both MIN and MAX matches for one message, the message is given an SCL of 0.ThanksAllen

Hi AllenWe want to allow Job Application Form to enter into MB (<CustomWeightEntry Type="BOTH" Change="MIN" Text="Job Application Form" />), I mentioned MIN in in XML file. We enabled archive option if SCL exceeds value 7, so we can able to see all those mails archived. Alen please tell me one thing, how I can exclude one sender or one domain from all filters including IMF in Exchange 2003. In current setup if we chnage the SCL value to 8, then many spams will enter users MB (Junk E-Mail folder). Our requirement is to forward those mails either with subject "Job Application Form" orsender IP or sender domainor sender ID to users' inbox and all those filters won't process those mails.Thanks in advance for your sopportRegardsLalServer Engineer

Hi,There are two parts to process the spam email on the IMF: Block e-mail messages at the gatewayor at the mailbox store.If a message has a rating higher than the gateway threshold, IMF takes the action specified. If the message has a rating below the gateway threshold, the message is sent to the Exchange mailbox store of the recipient. At the Exchange mailbox store, if the message has a higher rating than the mailbox store threshold, the mailbox store delivers the message to the user's Junk E-mail folder rather than to the Inbox.At the mailbox store, regardless of the SCL rating assigned to the message, Exchange delivers all messages from safe senders to the user's Inbox and all messages from blocked senders to the user's Junk E-mail folder. However, if the e-mail message has been blocked by the gateway threshold, it is not delivered to the user's Inbox because it is never delivered to the mailbox store.However, the message needs to be processed by all the filters one by one if all the fiters has been enabled. To exclude one sender or one domain from the filter,you canset the sender in the Safe Senders on the Outlook client or the Global accept list. You can view the article for your reference:http://exchangepedia.com/blog/2006/12/imf-wheres-whitelist.htmlTo better understand IMF and Exchange filtering, please refer to the below article:http://technet.microsoft.com/en-us/library/bb125125(EXCHG.65).aspxThanksAllen