Exchange Anti-Spam

[Xavier Mustin]

Install the Anti-Spam Components
Run the following commands in the Exchange Management Shell:

[PS] C:\Windows\System32>

cd 'C:\Program Files\Microsoft\Exchange Server\V14\Scripts'

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Scripts>

.\install-AntispamAgents.ps1

Close EMS, Restart the MSExchangeTransport service, and then re-open EMS.

Configure an RBL
PS: Google's DNS Servers + Spamhaus = Fail

Exchange 2007 and 2010

1. Click Start, All Programs, Microsoft Exchange Server 2007, Exchange Management Console and accept the UAC prompt
2. Expand Organization Configuration and select Hub Transport
3. In the Anti-Spam tab, open the IP Block List Providers feature
4. On the Providers tab, click Add
5. Enter "Spamhaus" as the provider name and "zen.spamhaus.org" as the lookup domain - I also do one for bl.spamcop.net
6. Select Match any return code and click OK

Another good one to use is the Barracuda RBL but it requires registration. More info here: http://www.barracudacentral.org/rbl

Exchange 2013
IPBlockListProvider1

Add-IPBlockListProvider -Name "SpamHaus IPBlockListProvider" -LookupDomain "zen.spamhaus.org" -BitMaskMatch 127.0.0.1

Set-IPBlockListProvider "SpamHaus IPBlockListProvider" -RejectionResponse "Your message was rejected because the IP address of the server sending your message is in the block list."

IPBlockListProvider2

Add-IPBlockListProvider -Name "SpamCop IPBlockListProvider" -LookupDomain "bl.spamcop.net" -IPAddressesMatch "127.0.0.2","127.0.0.5" -Priority 1

Set-IPBlockListProvider "SpamCop IPBlockListProvider" -RejectionResponse "Your message was rejected because the IP address of the server sending your message is in the block list."

Configure Content Filtering
Go into Content Filtering, Action tab, tick the first two. Really safe defaults are:

Delete: 9
Reject: 7

But we usually use 8 and 6.

Checking that the Anti-Spam is working
This script shows how many messages are matched by the different SCLs:

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Scripts>

.\get-AntispamSCLHistogram.ps1 -startDate 1/20/2013 | sort name

Name Value
---- -----
0 142
1 21
2 8
3 2
4 5
5 23
6 65
7 53
8 63
not available: content filtering was bypassed. 1
not available: policy is disabled. 11

And you can make sure the RBL is dropping spammers connections with the following command:

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Scripts>

.\get-AntispamTopRBLProviders.ps1

Name Value
---- -----
bl.spamcop.net 359