1 2 3 Previous Next 20 Replies Latest reply: Nov 20, 2014 3:56 PM by norbertg RSS

    MSME 8.0p1 - Getting too much spam

    norbertg

      As per the subject.

       

      We are getting way too much spam allowed through. I can see Anti Spam Settings policy under EPO.

       

      I saw there is an option for Message reputation threshold which is set to 80, what does 80 mean? Is there any doc on levels?

       

      Edit: Our AntiSpam setting:

      antispam_settings.png

       

      Message was edited by: norbertg on 14/07/14 12:50:06 PM
        • 1. Re: MSME 8.0p1 - Getting too much spam
          tlange

          i would suggest to lower the message rep score to between 51-55. scores between 51-79 means emails are high likely to be spam but there could be some emails that get caught which are legit emails.  80+ is always spam. 

           

          also you want to make sure that the spam rules are getting updated from the local exchange server.  if you log into the local msme gui and look at the version and updates section of the dashboard, the Update Information tab will show the anti-spam engine (9309) and Rules.  the rules should look something like this

           

          "core:5004:inlines:1078:streams:12#####:uri:17#####"

           

          if the rules version doesn't look like this then the anti-spam rules might not be fully up to date.   

          • 2. Re: MSME 8.0p1 - Getting too much spam
            norbertg

            Thanks I'll look into it.

             

            All messages even obvious spam are coming through with scores of -5000 and threshold of 5 is there a reason for this? e.g

             

            X-NAI-Spam-Flag: NO

            X-NAI-Spam-Threshold: 5

            X-NAI-Spam-Score: -5000

            X-NAI-Spam-Version: 2.2.0.9309 : core<5004> : inlines <1074> : streams

            <1239065> : uri <1791485>

            X-Auto-Response-Suppress: DR, OOF,AutoReply

            X-MS-Exchange-Organization-AVStamp-Mailbox:NAI;56076057;0;novirus

             

            I was expecting to see spam scores at least in the positive. Also would you happen to know how the system junk folder works? It hasn't caught any messages in 2 days.

             

            edit: I've lowered it down to 60 and if it doesn't go well will look at 55 next.

             

            Our core anti-spam setting:

            core-antispam.png

             

            Message was edited by: norbertg on 16/07/14 9:02:15 AM
            • 3. Re: MSME 8.0p1 - Getting too much spam
              Aidan

              A score of -5000 suggests that the sender\sender domain is on  "Whitelist from" or recipient or internal domain\internal user is on "Whiteilist to"

              • 4. Re: MSME 8.0p1 - Getting too much spam
                norbertg

                So I looked at this message which is obvious spam\phishing and it's not on the whitelist or blacklist and scores a -5000:

                 

                Received: from espmta125187.v4broadcaster.com (37.235.125.187) by

                EXCHSERVERNAME.DOMAINNAME.com (INTERNALIP) with Microsoft SMTP Server id

                14.3.195.1; Wed, 16 Jul 2014 19:04:26 +0930

                DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=esp; d=v4broadcaster.com;

                h=To:From:Reply-To:Subject:MIME-Version:List-Unsubscribe:Sender:Content-Type:Me ssage-ID:Date; i=rpl=3Decsv4.com@esp.v4broadcaster.com;

                bh=CzsKJev7kZApUbN9NEgmuE67+Kg=;

                b=dNrIib8oDmfKGFc1xE/TwZ2N/DsT1B0avIcpd4sQrsNReUrubhK4l7r3s6rBoUv4/XH09sufxd8A

                   jzr+J80E94gjEgQPAX5zlSk9nWmh/h15r9Gq5IJf/jlt3Yu5qF6I/X37oB8P9kxSJGnhxunVGrGP

                   ZCZWxtMcV+XbIgy7kNA=

                DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=esp; d=v4broadcaster.com;

                b=SQ3vwVkpkaDhLH4LxJG0HWoDyy+0yeiXykpBNFLAcR1zZnJdIWKaxqBjG0S5lO0HKfd9+7FTuHhS

                   paiSEtMXVPkdTTapzSYarCTjpL9RrHFaxFznLmEgy7iRIKptaJcJOpZSJagA9n+c9TD/vKX2jHlk

                   UJSwAYlTodW55PuI9r0=;

                Precedence: bulk

                To: <EMAILADDRESS>

                From: ECS <rpl@ecsv4.com>

                Reply-To: Reply <rpl@ecsv4.com>

                Subject: =?UTF-8?B?UGxlYXNlIGtlZXAgdGhpcyB0byB5b3Vyc2VsZg==?=

                MIME-Version: 1.0

                List-Unsubscribe: <http://maildata.v4broadcaster.com/u/l/88/3531/85/82148258/c420271aa3c66780d19fec 159f70c6fe>

                Sender: ECS <rpl=ecsv4.com@esp.v4broadcaster.com>

                Content-Type: multipart/alternative;

                          boundary="=_ffb5b67842ff58dcddf84b30ef63395b"

                Message-ID: <0.0.2FA.B90.1CFA0D8A02275BE.0@espmta125187.v4broadcaster.com>

                Date: Wed, 16 Jul 2014 10:30:47 +0100

                Return-Path: v4rp-82148258-88@esp.v4broadcaster.com

                X-MS-Exchange-Organization-AuthSource: EXCHSERVERNAME.DOMAINNAME.com

                X-MS-Exchange-Organization-AuthAs: Anonymous

                X-NAI-Spam-Flag: NO

                X-NAI-Spam-Threshold: 5

                X-NAI-Spam-Score: -5000

                X-NAI-Spam-Version: 2.2.0.9309 : core <5004> : inlines <1081> : streams

                <1239844> : uri <1791819>

                X-MS-Exchange-Organization-AVStamp-Mailbox: NAI;56076067;0;novirus


                 

                Message was edited by: norbertg on 17/07/14 8:43:04 AM
                • 5. Re: MSME 8.0p1 - Getting too much spam
                  norbertg

                  I've gone ahead and removed all our white listed senders. We only have our internal domain address(es) set under whitelisted recipients and blacklisted senders, i'll see how it goes and report back.

                   

                  We had a 3rd party spam filter on our firewall prior to a month ago, now MSME is taking on all the load and responsibility.

                   

                  Message was edited by: norbertg on 17/07/14 9:47:38 AM
                  • 6. Re: MSME 8.0p1 - Getting too much spam
                    norbertg

                    I sent an email from gmail to my work account and it still scored -5000. Whitelist sender is now empty and at 0.

                    • 7. Re: MSME 8.0p1 - Getting too much spam
                      Aidan

                      If you have a "Whitelist To" recipient/domain that means that all mail "to" that recipient/domain will get a score of -5000. 

                      • 8. Re: MSME 8.0p1 - Getting too much spam
                        norbertg

                        Thank you, scores are working now

                        • 9. Re: MSME 8.0p1 - Getting too much spam
                          norbertg

                          Whats the best way to have our internal scripts (via exchange smtp relay) bypass the spam filter\scoring system?

                          1 2 3 Previous Next