Networks

Ask something
Question Locked

SIFMSMSE 6.0 Spam Question

0 helpful
6 replies

by chrae

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm fairly new to Exchange server management and Symantec's Anti-Spam solution, so bear with me.

We're currently running SIFMSMSE version 6.0.7.253. The software is doing a great job of blocking spam for the most part, but a few of our users are still receiving 5-10 spam mails a day whereas most of us aren't receiving any. We're a small company with about 50 users, and of those 50 users, only 3 of us receive spam (from what I have heard). So what I'm more or less trying to figure out is why these mailboxes aren't being filtered like the rest of ours, and if there's anything I can do to step up the protection for these users.

The spams they're receiving vary so much that creating rules and exceptions for the different types isn't really a viable option. I apologize if this is vague, but if somebody can help me understand it would be greatly appreciated.

6 replies

by thumbsup2

Are the SPAMS which get through addressed to everyone (if you can tell), or are they only addressed to the people who actually receive them?

In other words, if all things are equal, one person should not receive something that everyone else is not.

Perhaps the spam filters aren't set tight enough?

by chrae

The spam that is sneaking through is sent directly to the user's address and no users have received duplicate spam mail, so it's targeted.

To give a few statistics, since this was installed and configured (before I took the lead IT role in this company), Symantec AntiSpam has determined 240,000 e-mails weren't spam, 98,000 were spam, and 2,000 are suspected spam.

Maybe the suspected spam is what's getting through? Under Spam Scoring in AntiSpam options, Flag Messages as Suspected Spam is enabled, then it goes on to say that suspected spam message score between 25 and 89, and under that is a setting called Lower Spam Theshold which is currently set to 72.

This means little to me at this time because it's my first time digging in this software, but could this potentially be the root cause of the problem, and should I try raising/lowering that score threshold?

by cg it

what type of spam? Usually about the only type of spam that defeats spam filtering software is the self sending spam.

If you are stickly using the Bayesian filter, you might want to turn that off for a bit and rely upon the Razer, DNS, Blacklist, etc [other list filters] and have the software action drop the connection. If the spam gets through, check the whitelist. See if it's listed there. If so, remove it.

Note: Like most consumer level firewalls, spam filters assume that emails send out are legitimate, thus those recipient addresses are marked as whitelist.

by chrae

I guess I'll just toggle a few of those settings and monitor it for a while, see if there's an influx of spam or if it slows down. Trial and error for the most part. I just wish I were around when they set it up, or that the man I replaced actually documented something.

by cg it

Most products come with "out of the box" protection for most spam. but for those pesky few that seem to always get through there does require some tweaking.

The other thing is baselining. Documentation is only as good as it's baseline. Have to decide what is the baseline and go from there. If your constantly tweaking the system, you haven't established a baseline thus as set of documentation really doesn't reflect the system. Establish a baseline, then document it.

This discussion is closed to new replies.