Exchange Server 2003 SP2 represents an important step toward alleviating the spam epidemic. Let’s look at what it provides.

Sender ID   Exchange Server 2003 SP2 delivers the long-awaited Sender ID filtering technology, which primarily targets forgery of e-mail addresses. The elimination of spoofed mail will immediately cause a significant reduction of mail traffic into the Exchange organization. Preliminary data from the internal IT department at Microsoft shows that enabling the Sender ID filter allowed Microsoft to achieve an approximately 10 percent net increase in spam capture before mail is transmitted to Exchange Intelligent Message Filter for additional anti-spam processing. Stopping spoofed mail at the gateway is important because the reduction of mail traffic into the Exchange organization reduces bandwidth consumption and eliminates the overhead of processing these messages in the internal mail infrastructure.

Intelligent Message Filter   A second important addition to the existing Exchange Server 2003 anti-spam features is the inclusion of Microsoft SmartScreen™ technology in the form of Intelligent Message Filter. Previously, Intelligent Message Filter was available as an add-in tool only. Now Intelligent Message Filter is an important part of Exchange Server 2003. Intelligent Message Filter contains updated spam characteristics that improve its ability to block spam. And on top of that, Intelligent Message Filter provides anti-phishing protection.

Connection Filtering Behind the Perimeter   Connection filtering was introduced in Exchange Server 2003, but it worked from the network perimeter only. Because most servers running Exchange Server 2003 are positioned behind the network perimeter, the Connection filtering functionality was not possible. Exchange Server 2003 SP2 changes all this by enabling deployment of connection filtering not only at the network perimeter, but behind it too. Now you can take full advantage of message hygiene and anti-spam enhancements, regardless of where your Exchange server is deployed.

Before you enable Sender ID on a server running Exchange Server 2003 SP2, make sure to apply the Microsoft Windows Server™ 2003 hotfix that is documented in Microsoft Knowledge Base article 905214, “Windows Server 2003 or Windows 2000 Server may stop responding when you enable the “Sender ID Filtering” setting on an SMTP virtual server in Exchange Server 2003 SP2."

Note:
If you are running Microsoft Windows® 2000 Server, contact Microsoft Product Support Services (PSS) for support assistance. Windows 2000 Server is in extended support mode only.

Sender ID focuses on one of the most common and deceitful practices used by spammers: domain spoofing. The term domain spoofing refers to the use of someone else's domain name when sending a message. Domain spoofing is part of the larger problem of spoofing, which is the practice of forging a sender's address on e-mail messages. Domain spoofing can also be used by malicious individuals in phishing scams, which try to lure consumers into disclosing sensitive personal information by pretending the e-mail is from a trusted source, such as a consumer's bank. Disclosure of such information could lead to identity theft and other online consumer fraud.

Sender ID is an e-mail authentication protocol that verifies the origin of the e-mail and prevents forged mail from entering an Exchange organization. In essence, Sender ID asks a question: “Has this e-mail message been spoofed?” If the answer is “Yes, it has been spoofed,” the Sender ID filter rejects or deletes the message immediately. If the answer is “No, we can confirm the sender’s authenticity,” the message is assigned a Sender ID status and transmitted to Intelligent Message Filter, if Intelligent Message Filter is enabled on the server, for additional anti-spam processing.

So how does Sender ID work? Sender ID functionality relies, in part, on an algorithm that is implemented in the Sender ID filter detects the purported responsible address (PRA). PRA is the e-mail address of the entity that is most recently responsible for injecting a message into the e-mail system. The Sender ID filter determines the actual e-mail domain by locating the first definition of the following RFC2822 message headers in this order:

1. Resent-Sender
   
2. Resent-From
   
3. Sender
   
4. From
   

If none of these headers is found, the Sender ID filter uses the STMP RFC 2821 MAIL FROM value.

Figure 1   How Sender ID Works

Here are the steps in the Sender ID verification process in Figure 1:

1. A sender sends an e-mail message to the receiver.
   
2. The receiver’s inbound mail server receives the e-mail message and extracts the PRA.
   
3. The inbound mail server checks which domain claims to have sent the message, and examines the domain name system (DNS) for the sender policy framework (SPF) record of that domain. These SPF records identify authorized outgoing e-mail servers. The inbound server determines whether the sending e-mail server's IP address matches any of the IP addresses that are published in the SPF record. For more information about what an SPF record contains and how to create an SPF record, see Sender ID.
   
4. If the IP addresses match, the e-mail message is authenticated and delivered to the receiver. If the IP addresses do not match, the e-mail message fails authentication and is not delivered.
   

Based on the evaluation of the Sender ID record, every message is stamped with a Sender ID status. Intelligent Message Filter considers this status for the final assignment of an SCL rating, if Intelligent Message Filter is enabled on the server and the status is also available as an output from the Sender ID filter.

The Sender ID status reflects the results of the Sender ID filtering process. The Sender ID status can be one of the following:

Sender ID Administration

In Exchange Server 2003 SP2, Intelligent Message Filter comes preloaded with anti-phishing protection and supports a custom weights list.

In Exchange Server 2003 SP2, anti-phishing functionality is completely transparent to the end user. The anti-phishing technology is fully incorporated into the Intelligent Message Filter engine. All incoming mail is verified against phishing scams first and according to findings that correspond to a phishing confidence level (PCL) that is applied to each e-mail message. The PCL triggers assignment of the final SCL score.

Another new piece of functionality is custom weights list, also known as custom weighting. The custom weights list enables administrators to customize Intelligent Message Filter behavior based on text strings in an e-mail message body and headers. The custom weights list is made available in the form of an XML configuration file that is read by the Intelligent Message Filter upon initialization, and is subsequently reloaded whenever the XML configuration file changes. No user interface is associated with the custom weights list.

The custom weights list isn’t created during installation of Exchange Server 2003 SP2. Therefore, you must create it manually and put it in the default location for Intelligent Message Filter files: <path to Exchange server binary files>\MSCFv2\

Note:
In this path, <path to Exchange server binary files> refers to the location of the bin folder.

This is an example of the custom weights list file:

<?xml version="1.0" encoding="UTF-16"?>
<CustomWeightEntries xmlns="http://schemas.microsoft.com/2005/CustomWeight">
     <CustomWeightEntry Type="SUBJECT" Change="1" Text="foo1"/>
     <CustomWeightEntry Type="BODY" Change="-1" Text="foo2"/>
     <CustomWeightEntry Type="BODY" Change="5" Text="Special offer"/>
     <CustomWeightEntry Type="BODY" Change="-9" Text="Verlängertes Angebot"/>
     <CustomWeightEntry Type="BOTH" Change="MAX" Text="Offre spéciale"/>
</CustomWeightEntries>

The following table shows the values for each entry in the custom weights list.

These Exchange Server 2003 message hygiene and anti-spam enhancements enable administrators to create a layered, end-to-end anti-spam solution that better defends their Exchange organization against spam.