configuring VAMSoft ORF anti-spam on an Exchange server

If I was to rank spam software for Exchange servers, I'd rank them this way:

1) Postini and other off-site similar services

2) GFI Mail Essentials

3) VAMSoft ORF

However, ORF costs way less. As of August 2011, ORF is $249 for the first year and then $99 each year thereafter. This is for unlimited users.

Also, ORF requires minimal configuration, which I'll go over here.

After installing ORF, the first change I make is to add an external DNS server. I add Google's public DNS, 8.8.8.8 as seen here:

The next thing I do is enable the tests I like. Unfortunately, before I did the installation where I took these screen shots, I didn't track which tests I enabled. It's only three or four tests, but here is a screen shot with all the tests I enabled after I had enabled them:

In the test for DNS blacklists, I enable SpamHaus Zen and SpamCop:

The last change I make is to add URL blacklists. I have it check the combined SURBL list and uribl.com blacklist.

After making those changes, click Configuration -> Save Configuration. Then go to Information -> Status Information and choose Start to start the ORF service.

Separately, I also disable any other spam filters. Almost always, I'm replacing the built in spam features in Exchange. I open Exchange Management Console and go to the various hub transport modules and disable any and all spam tests in the anti-spam tab.

adding anti-spam features to single server Exchange 2010

I built a single Exchange 2010 box, as opposed to one with an edge server - and there were not anti-spam features present. Normally, you'd find the anti-spam features in edge transport in the Exchange Management Console (EMC).

But since there is no edge transport server, you can add the anti-spam functionality (so that it appears in Organization Configuration -> Hub transport and some in Server Configuration -> Hub transport. In each case, there's an anti-spam tab.

To add it, enter these commands:

1. Run the following command from the %system drive%/Program Files\Microsoft\Exchange Server\Scripts folder.

./install-AntispamAgents.ps1

2. After the script has run, restart the Microsoft Exchange Transport service by running the following command.

Restart-Service MSExchangeTransport

adding blacklists to Exchange 2007

IMF in Exchange 2007 is more configurable than in Exchange 2003, but I find it more cumbersome than GFI Mail Essentials, which I love.

For this particular Exchange 2007 server (via SBS 2008), I had users complaining about Microsoft and Facebook spam. Since the IMF updates were not adjusting the content filtering to adjust for these messages, I decided to add black lists. I have hated black lists for years, as I occasionally find myself on them and it's a bitch getting off of them - but conceptually, if the blacklist is accurate with no false positives, it should be a very good tools.

OF NOTE - you should limit your number of blacklists to 3. See this post for more information

To configure it, I opened up Exchange Management Console -> Organization Configuration -> Hub Transport and went to the anti-spam tab. I went into IP block list providers and added these blacklists:

zen.spamhaus.org
list.dsbl.org
combined.njabl.org
bhnc.njabl.org
dnsbl.ahbl.org


Here are some others I could have added:

dnsbl.sorbs.net
bl.spamcop.net
dnsbl-1.uceprotect.net

whitelisting IPs in Exchange 2007 to bypass content filter

There are two places to adjust the anti-spam filter in Exchange Management Console. One place is in Organization Configuration -> Hub Transport.

But that doesn't help if you want to whitelist an IP address. You have to use the other anti-spam location in Server Configuration -> Hub Transport.

It looks like this: