How to flag SPAM in MS Exchange/Outlook using Mailscanner?

[Kevin Miller]

Thiago Martins wrote:
> Hi Kevin.
> 
> Thanks for the link. I will test spambayes.
> 
> I know that changing the subject is the easiest way, but you know, our
> bosses never want the easy way. :)

Yup.  Can't blame them though - it does make the subject line uglier.  Especially for false positives.


> I have other problems too. Here we don´t allow any mail marked as SPAM
> (high or not) to go to the user. There is a dedicate person to check
> the quarantine and release false positives. Maybe it would be nicer to

I reject high scoring spam, and quarantine low scoring spam.  I don't usually check for false positives though unless someone calls and asks if something got lost.  It's pretty infrequent.   The quarantined messages live on the MailScanner box and are deleted after a month.  I don't think I'd set it up to pass low scoring spam.  My users seem pretty happy with things as they are.


> let low spam pass and let the user decide. But not a long ago there
> was Lotus Notes + Securiq and this behavior is a legacy from those
> suffering times and it will take some time to change this.
> 
> We still have some Notes clients, but in a year they will rest in
> peace ... 
> 
> The exchange admin told me that it is not possible to create a rule
> from the server to play with the subject and move messages to the spam
> folder in outlook. That´s why I want to play with IMF. This way I can
> store only high spam and let low spam pass to the users.

I don't know any way to get a server side rule to do that without an addin, but I've never looked into it really either.  I think he's right though.  Would be nice if there were an easy way.  


> I have to assume users are very dumb and can´t create a rule by them.
> If this can be done using any kind of GPO or using the exchange server
> or adding headers to be parsed by IMF it will be my choice.

Most will figure it out, especially if you do up some directions.  The rest benefit from some personal attention.  Don't know how many users you have; we're running around 400.  Most we never hear from.  Are you using MailWatch (mailwatch.sourceforge.net)?  It can be configured to let your users check for themselves.

Some months back there was a discussion here about adding headers with MailScanner that the IMF would recognize and act upon.  Check the archives for this subject: "RE: Setting Exchange SCL from MailScanner", particularly Brian Duncan's reply on Feb 12, 2007.


> I have no experience with exchange. I always used Unix mailers and
> MTAs so I´m a bit lost here.

HTH...

...Kevin
-- 
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500