6 Replies Latest reply: Feb 24, 2014 3:38 AM by Aidan RSS

    MSME Anti-Spam




      I have MSME v8.0 installed on epo 5.0. I want to test anti-spam module.

      Although the spam rules are present  in the mail which is sent ,eg:32HEX_AT_LHLD_W_NAI_BAD_URI

      But the epo is not detecting it as spam.Also i tried to blacklist  a sender and send mails through that mail id,but no sucess.It is not blcocking it.

      Can anyone help out with that.



        • 1. Re: MSME Anti-Spam

          I've moved this provisionally to Email Security (Groupshield) as a better spot for support.

          • 2. Re: MSME Anti-Spam

            ePO performs no scanning or does not provide protection - it provides manageability of the mcafee products and reporting on activities of the point products, provision or updates via repositories etc etc 


            MSME 8 will be installed on server(s) running Microsoft Exchange!! AntiSpam will work on MSME on server hosting Transport Roles or  Transport capability. . 


            Can you clarifyy exct version of Exchange (relevant SPs/CUs), MS Exchange Roles  and exact version of MSME (Patch/RUs/Hfs) and if the AntiSpam component is deployed and licensed??

            • 3. Re: MSME Anti-Spam

              I have MSME 8 installed on  Exchange Server 2007 Version: 08.01.0240.006


              The Anti-Spam Engine - Rules Version component is deployed on Exchange Server.

              Can u help out why anti-sapm component is not working event if rules are present in mail which are sent.


              Message was edited by: jyotiu on 2/19/14 11:58:20 PM CST
              • 4. Re: MSME Anti-Spam

                I'm afraid MSME 8 has a support requirement of Exchange 2007 SP3  - the version number you quote suggests its E2007SP1.

                The supported levels are

                • Microsoft Exchange Server 2007 SP3

                • Microsoft Exchange Server 2010 SP2

                • Microsoft Exchange Server 2013


                Do you mean that you have enabled reporting in the header for the mails and you see the X-NAI additions in the header? Then you should also see a Spam Score.  Basically a mail is given a series of score based on spam rules detected and these are totalled to provide an overall score for the mail.


                The action taken on the mail depends on the score - there are three score levels that are configured in MSME Anti Spam Settings

                Low, Medium and High  - default score for these are 5, 10 and 15

                Means that below score of 5 - its treated as non-spam - no action.

                Low - score between 5 and 10 - default action is allow through

                Medium - score between 10 and 15 - default action is delete quarantine

                High - score 15+  - default action is delete quarantine.


                So I guess need to understand the scoing of the mail and your configuration. e.g. if you use default settings for scores and mail has spam traits listed in header and which total less than 5 it is not treated as spam, or between 5-10 then it is recognised as spam and allowed through.


                But it would be vitally importanf to get the exchange upgraded to SP3  - because we cannot guarantee the antispam transport agent is working correctly in SP1.

                • 5. Re: MSME Anti-Spam

                  Thanks Aiden for instance response!



                  I have default settings in Core-anti-spam. PFA. I have enabled reporting in the header,I am trying to send the mails from the user which is blacklisted,but it is not detecting as spam.

                  Also,from external mail address if mail's subject or body has rules matching as per  anti-spam  rules dictionary,but the spam score is not getting assgined.



                  Can u please help to  guide me how to generate spam score or block the blacklisted user.?


                  Message was edited by: jyotiu on 2/21/14 5:36:33 AM CST
                  • 6. Re: MSME Anti-Spam

                    For testing - you could set "Attach Spam Report" to "All Mail and enable "Verbose Report".

                    (As you state you have ePO - if ePO is managing MSME configuration you will have to do this in ePO).


                    AntiSpam Implentaiton in MSME is to scan mail for spam in incoming mail only (or mail considered to be from an external source).

                    (AV, FF and content etc are scanned for in all mail (incoming, outgoing, internal))


                    If you are testing an internal mail address as Blacklist this will not work, as It has to be coming from an external source.