The recommended option is to deploy the Edge Transport server role outside the Exchange organization in an organization's perimeter network. The Edge Transport server can be deployed as a stand-alone server or as a member of a perimeter Active Directory domain.
For more information about how to deploy an Edge Transport server in an Exchange 2007 organization in a perimeter network, see the following topics:
The following table lists the advantages of the different types of Edge Transport server deployment.
When you install an Edge Transport server, you enable anti-spam functionality on that server. When you add an Edge Transport server to your Exchange 2007 perimeter network, you must subscribe the Edge Transport server to an Active Directory site by using the Edge Subscription process if either of the following conditions is true:
When you deploy more than one Edge Transport server in an Exchange 2007 organization in the perimeter network of a domain or workgroup, you can load-balance SMTP traffic among all Edge Transport servers by defining more than one MX resource record with the same priority in the Domain Name System (DNS) database for your mail domain. Deploying more than one Edge Transport server also provides fault tolerance.
The following table compares features that are available for the different deployment options for Edge Transport servers in an Exchange 2007 organization.
|
|
Edge Transport server is not deployed
|
Edge Transport server is deployed in an Active Directory forest that services the Exchange organization
|
Recommended: Edge Transport server role is deployed in the perimeter workgroup or perimeter domain
|
Comments or description
|
|---|
|
Minimum number of servers
|
1
|
2
|
2
|
The Edge Transport server role cannot be installed on the same computer as the other server roles. In the single-server scenario, anti-spam agents are manually deployed on the Hub Transport server role. The Edge Transport server role is not installed.
|
|
Network isolation
|
No
|
No
|
Yes
|
Spam and malware are rejected before they enter the network only if the Edge Transport server role is deployed at the perimeter network.
|
|
Anti-spam agents installed by default
|
No
|
Yes
|
Yes
|
If the Edge Transport server role is not deployed, an administrator can enable anti-spam agents on the Hub Transport server role by running an Exchange Management Shell command. For more information, see How to Enable Anti-Spam Functionality on a Hub Transport Server.
|
|
Anti-spam user interface
|
Anti-spam user interface is not visible by default. It is enabled after anti-spam agents are deployed manually.
|
Visible by default
|
Visible by default
|
The Exchange Management Console provides a user interface for configuring the following:
-
Anti-spam functionality
-
Receive connectors
-
Send connectors
-
Transport rules
|
|
Internet e-mail processing
|
Internet e-mail processing is enabled only after you set the Internet usage type on the Receive connector, and create a new Send connector with the Internet usage type.
|
Yes
|
Yes
|
For more information, see How to Configure Connectors for Internet Mail Flow.
|
|
Connection Filtering
|
Yes
|
Yes
|
Yes
|
Connection filtering provides IP Block lists and IP Allow lists to protect against spam. For more information, see Connection Filtering.
|
|
Sender Filtering
|
Yes
|
Yes
|
Yes
|
Sender reputation is dynamically analyzed and updated over time. For more information, see Sender Filtering.
|
|
Recipient Filtering
|
Yes
|
Yes
|
Yes
|
Recipients are validated by using the global address list (GAL). For more information, see Recipient Filtering.
|
|
Microsoft Exchange EdgeSync service
|
Not applicable
|
Yes
|
Yes
|
Microsoft Office Outlook Safe Senders lists and the GAL are pushed in encrypted format to the network perimeter.
|
|
Sender ID
|
Yes
|
Yes
|
Yes
|
Sender ID is checked when e-mail is received and included in spam rating. For more information, see Sender ID.
|
|
Content Filtering (Intelligent Mail Filtering)
|
Yes
|
Yes
|
Yes
|
Regular Microsoft SmartScreen updates help counter spam and phishing threats. For more information, see How to Configure Anti-Spam Automatic Updates.
|
|
Spam confidence level
|
Yes
|
Yes
|
Yes
|
A spam confidence level (SCL) rating is assigned to a message, based on several factors. For more information, see Adjusting the Spam Confidence Level Threshold.
|
|
Anti-spam stamp
|
Yes
|
Yes
|
Yes
|
Messages are stamped with details of spam assessment. For more information, see Anti-Spam Stamps.
|
|
Back pressure and tarpitting
|
Yes
|
Yes
|
Yes
|
Back pressure and tarpitting protect against denial of service and directory harvest attacks. For more information, see the Understanding Back Pressure and the "Tarpitting Functionality" section of Recipient Filtering.
|
|
Two-tiered spam quarantine
|
Yes
|
Yes
|
Yes
|
An administrator can access the spam quarantine folder and release a message to its recipient. For more information, see Spam Quarantine.
|
|
Attachment Filtering
|
No
|
Yes
|
Yes
|
Attachments are removed based on size, content, or file type. For more information, see Attachment Filtering.
|
|
Forefront Security for Exchange Server
|
Yes
|
Yes
|
Yes
|
For more information, see Protecting Your Microsoft Exchange Organization with Microsoft Forefront Security for Exchange Server.
|