Understanding spam processing
To understand the antispam functionality in Forefront Protection 2010 for Exchange Server, it is best to begin by dividing it into three logical layers: the connection filtering layer (also known as the IP filtering layer), the SMTP protocol-analysis layer, and, finally, the content filtering layer. Processing mail in distributed layers is important because removing spam at each layer can free up resources in your network. To illustrate, if spam messages are filtered at the connection layer, those messages will not pass through additional parts of your network. This results in a reduction in network traffic and reduced load on servers.
In the following topics, the three layers are explored in detail.