Content filtering
The content filtering layer is the last level of spam processing, after connection filtering and SMTP filtering. The content filtering layer uses the Cloudmark Authority engine, which is one of the most effective content scanning engines available.
The engine assigns a spam confidence level (or SCL) to each incoming message. The SCL determines the likelihood that a message is spam. Typical scores are SCL:-1 for a legitimate message and SCL:9 for a spam message. By assigning a high SCL score for each spam message, the engine ensures that fewer messages are quarantined, which means that end users do not have to spend a lot of time checking quarantined or junk email for false-positive messages. According to Microsoft’s unofficial metrics, for every million incoming messages, less than fifty are quarantined. If you would like to see a more in-depth discussion of spam confidence levels, see Understanding Spam Confidence Level Threshold in the Exchange Server 2010 documentation. The vital difference between Exchange and FPE 2010 for Exchange SCL assignment logic is that FPE will assign SCL:-1 to all messages determined not to be spam. This is default behavior, but it can be modified by means of the FPE 2010 cmdlet to assign SCL:0 instead of SCL:-1 to all messages determined not to be spam.
The Cloudmark engine is typically updated every 45 seconds. This enables the engine to be constantly up-to-date and prepared for new spam attacks. Updates are automatic, and there is no need to enable them explicitly.
For more details about enabling content filtering, see Configuring content filtering.
For a more in-depth discussion of how the content filter engine detects and filters incoming spam messages, see the Forefront Protection 2010 for Exchange Server Antispam Framework white paper, located on the white papers page of the Forefront Protection 2010 for Exchange Server website.