IMF: Where’s the whitelist?

Another frequently asked question – asked frequently enough to make its way here.

Does the Intelligent Message Filter (IMF) v1/v2 in Exchange 2003 provide any way of “whitelisting” sending SMTP addresses or domains? (I will continue to use whitelisting as one word. Although it cannot be found in the dictionary, it is a common term if you’re reading this blog and work with messaging/anti-spam – Bharat)

The Sender Filtering feature provides a way to blacklist SMTP addresses and domains, so it’s logical to expect a way to whitelist addresses and domains as well. However, there’s no whitelisting feature in Exchange 2003 – or at least not out-of-the-box.

From the explanations I’ve heard, the one that comes across as the most reasonable: SMTP headers (and therefore the FROM: field in messages) can be easily spoofed. To a certain extent, it’s hard to argue with that – it is true, and that is perhaps one of the biggest reasons we have to deal with spam and phishing today.

Some workarounds for whitelisting
In absence of a whitelist feature built into IMF, here’s what can be done to ensure messages from trusted sources are not blocked:

 Global Accept List: Adding the IP address(es) of sending hosts to Connection Filtering‘s Global Accept List allows messages from the sending host to bypass Connection Filtering — inbound messages will be accepted even if the sending host is listed on a RBL, and IMF as well. To add IP addresses of sending hosts to the Global Accept list using the ESM:
1. Expand Global Settings | select Message Delivery -> Properties | Select the Connection Filtering tab

Figure 1: Connection Filtering’s Global Accept List allows you to whitelist IP addresses of sending hosts

2. Click Accept | Click Add
3. To add a single IP address, type the address in the IP address field. To add a range of IP addresses, select Group of IP Addresses and type the subnet address and mask.
4. Click OK (thrice) to close the dialog boxes.

Next, we need to enable Connection Filtering in SMTP virtual server properties.
5. Select the SMTP Virtual Server that receives inbound internet mail | select Properties | General tab | Advanced button next to IP address
6. Select an IP address (you can enable/disable filters by IP address)
7. Click the Edit button
8. Check Apply Connection Filter

Figure 2: Antispam filters can be selectively enabled or disabled in SMTP Virtual Server properties

By whitelisting sending hosts’ IP address(es), you’re telling Exchange the sending host is trusted. Arguably, this is more effective and secure than whitelisting SMTP addresses and domains. (Also read Alexander Zammit’s post regarding issues with having the same IP address on Global Accept list and on the local IP list).

Nevertheless, some folks would simply like to have the convenience of whitelisting addresses and domains. Almost every other anti-spam tool has it. (Update: Exchange 2007 has whitelisting. See Exchange 2007 Content FIlter: The Whitelist Is Here!)

 Custom Weighting: If the messages you want to whitelist contain particular keywords in the subject or message body, you can use the Custom Weighting feature as described in Exchange Server 2003 SP2 Release Notes. This allows you to lower or raise the SCL values assigned by IMF.

This entails creating an XML file called MSExchange.UceContentFilter.xml– the syntax is described in the Release Notes. You can simply cut and paste the sample from the Release Notes and modify it – it is fairly easy to do.

This approach could have been made a little more effective by simply allowing to look for the keywords in message headers as well. Not sure why headers were not included in the scanning mechanism for Custom Weighting – hopefully I will come across a reasonable explanation for this as well. :)

 IMF Tune: If the above methods don’t work for you, and you absolutely need the convenience of being able to whitelist addresses and domains, you can look at third party utilities like IMF Tune from WinDeveloper. IMF Tune is an inexpensive tool that adds important functionality to IMF, making it closer to a full-blown anti-spam tool that many want IMF to be.

Besides whitelisting, IMF Tune allows you to configure a quarantine mailbox (instead of IMF’s option to archive mail in the UceArchive folder), setup autoreplies for filtered mail, strip attachments, amongst other things.

Another likable IMF Tune feature is the ability to insert SCL values in message headers – which IMF will do for archived messages, but not for messages delivered to mailboxes. The SCL value is a MAPI property of a message that can be made to show up in Outlook [read ‘Exposing SCL (Spam Confidence Level) in Outlook‘ on Exchange team blog], but the procedure isn’t something most users would want to go through.

Having said this, I have always liked IMF and think Microsoft did a great job by including this – for free – as a web download with IMF v1, and as a part of Exchange Server 2003 SP2 with IMF v2. It serves a useful purpose in many small/SMB deployments where it meets the requirements to a good extent or where resource
constraints rule out buying a third-party anti-spam product.

Besides, much as product managers want, not all features can be implemented in any given version, and given historical data, by version 3 these features/products become much more mature. (Think of the anti-spam features in Exchange Server 2007 as version 3 of Exchange’s messaging hygiene features :).

Tags
Anti-Spam