cancel
Showing results for 
Search instead for 
Did you mean: 
norbertg
Level 12
Report Inappropriate Content
Message 1 of 21

MSME 8.0p1 - Getting too much spam

Jump to solution

As per the subject.

We are getting way too much spam allowed through. I can see Anti Spam Settings policy under EPO.

I saw there is an option for Message reputation threshold which is set to 80, what does 80 mean? Is there any doc on levels?

Edit: Our AntiSpam setting:

antispam_settings.png

Message was edited by: norbertg on 14/07/14 12:50:06 PM
1 Solution

Accepted Solutions
Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 8 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

If you have a "Whitelist To" recipient/domain that means that all mail "to" that recipient/domain will get a score of -5000. 

20 Replies
Highlighted
McAfee Employee tlange
McAfee Employee
Report Inappropriate Content
Message 2 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

i would suggest to lower the message rep score to between 51-55. scores between 51-79 means emails are high likely to be spam but there could be some emails that get caught which are legit emails.  80+ is always spam. 

also you want to make sure that the spam rules are getting updated from the local exchange server.  if you log into the local msme gui and look at the version and updates section of the dashboard, the Update Information tab will show the anti-spam engine (9309) and Rules.  the rules should look something like this

"core:5004:inlines:1078:streams:12#####:uri:17#####"

if the rules version doesn't look like this then the anti-spam rules might not be fully up to date.   

norbertg
Level 12
Report Inappropriate Content
Message 3 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

Thanks I'll look into it.

All messages even obvious spam are coming through with scores of -5000 and threshold of 5 is there a reason for this? e.g

X-NAI-Spam-Flag: NO

X-NAI-Spam-Threshold: 5

X-NAI-Spam-Score: -5000

X-NAI-Spam-Version: 2.2.0.9309 : core<5004> : inlines <1074> : streams

<1239065> : uri <1791485>

X-Auto-Response-Suppress: DR, OOF,AutoReply

X-MS-Exchange-Organization-AVStamp-Mailbox:NAI;56076057;0;novirus

I was expecting to see spam scores at least in the positive. Also would you happen to know how the system junk folder works? It hasn't caught any messages in 2 days.

edit: I've lowered it down to 60 and if it doesn't go well will look at 55 next.

Our core anti-spam setting:

core-antispam.png

Message was edited by: norbertg on 16/07/14 9:02:15 AM
Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 4 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

A score of -5000 suggests that the sender\sender domain is on  "Whitelist from" or recipient or internal domain\internal user is on "Whiteilist to"

norbertg
Level 12
Report Inappropriate Content
Message 5 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

So I looked at this message which is obvious spam\phishing and it's not on the whitelist or blacklist and scores a -5000:

Received: from espmta125187.v4broadcaster.com (37.235.125.187) by

EXCHSERVERNAME.DOMAINNAME.com (INTERNALIP) with Microsoft SMTP Server id

14.3.195.1; Wed, 16 Jul 2014 19:04:26 +0930

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=esp; d=v4broadcaster.com;

h=To:From:Reply-To:Subject:MIME-Version:List-Unsubscribe:Sender:Content-Type:Message-ID:Date; i=rpl=3Decsv4.com@esp.v4broadcaster.com;

bh=CzsKJev7kZApUbN9NEgmuE67+Kg=;

b=dNrIib8oDmfKGFc1xE/TwZ2N/DsT1B0avIcpd4sQrsNReUrubhK4l7r3s6rBoUv4/XH09sufxd8A

   jzr+J80E94gjEgQPAX5zlSk9nWmh/h15r9Gq5IJf/jlt3Yu5qF6I/X37oB8P9kxSJGnhxunVGrGP

   ZCZWxtMcV+XbIgy7kNA=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=esp; d=v4broadcaster.com;

b=SQ3vwVkpkaDhLH4LxJG0HWoDyy+0yeiXykpBNFLAcR1zZnJdIWKaxqBjG0S5lO0HKfd9+7FTuHhS

   paiSEtMXVPkdTTapzSYarCTjpL9RrHFaxFznLmEgy7iRIKptaJcJOpZSJagA9n+c9TD/vKX2jHlk

   UJSwAYlTodW55PuI9r0=;

Precedence: bulk

To: <EMAILADDRESS>

From: ECS <rpl@ecsv4.com>

Reply-To: Reply <rpl@ecsv4.com>

Subject: =?UTF-8?B?UGxlYXNlIGtlZXAgdGhpcyB0byB5b3Vyc2VsZg==?=

MIME-Version: 1.0

List-Unsubscribe: <http://maildata.v4broadcaster.com/u/l/88/3531/85/82148258/c420271aa3c66780d19fec159f70c6fe>

Sender: ECS <rpl=ecsv4.com@esp.v4broadcaster.com>

Content-Type: multipart/alternative;

          boundary="=_ffb5b67842ff58dcddf84b30ef63395b"

Message-ID: <0.0.2FA.B90.1CFA0D8A02275BE.0@espmta125187.v4broadcaster.com>

Date: Wed, 16 Jul 2014 10:30:47 +0100

Return-Path: v4rp-82148258-88@esp.v4broadcaster.com

X-MS-Exchange-Organization-AuthSource: EXCHSERVERNAME.DOMAINNAME.com

X-MS-Exchange-Organization-AuthAs: Anonymous

X-NAI-Spam-Flag: NO

X-NAI-Spam-Threshold: 5

X-NAI-Spam-Score: -5000

X-NAI-Spam-Version: 2.2.0.9309 : core <5004> : inlines <1081> : streams

<1239844> : uri <1791819>

X-MS-Exchange-Organization-AVStamp-Mailbox: NAI;56076067;0;novirus


Message was edited by: norbertg on 17/07/14 8:43:04 AM
norbertg
Level 12
Report Inappropriate Content
Message 6 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

I've gone ahead and removed all our white listed senders. We only have our internal domain address(es) set under whitelisted recipients and blacklisted senders, i'll see how it goes and report back.

We had a 3rd party spam filter on our firewall prior to a month ago, now MSME is taking on all the load and responsibility.

Message was edited by: norbertg on 17/07/14 9:47:38 AM
norbertg
Level 12
Report Inappropriate Content
Message 7 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

I sent an email from gmail to my work account and it still scored -5000. Whitelist sender is now empty and at 0.

Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 8 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

If you have a "Whitelist To" recipient/domain that means that all mail "to" that recipient/domain will get a score of -5000. 

norbertg
Level 12
Report Inappropriate Content
Message 9 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

Thank you, scores are working now

norbertg
Level 12
Report Inappropriate Content
Message 10 of 21

Re: MSME 8.0p1 - Getting too much spam

Jump to solution

Whats the best way to have our internal scripts (via exchange smtp relay) bypass the spam filter\scoring system?

More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support
  • The McAfee ePO Support Center Plug-in is now available in the Software Manager. Follow the instructions in the Product Guide for more.