Κοινή χρήση μέσω

Content filtering

  • Άρθρο

Note

In November, 2016, Microsoft stopped producing spam definition updates for the SmartScreen filters in Exchange and Outlook. The existing SmartScreen spam definitions were left in place, but their effectiveness will likely degrade over time. For more information, see Deprecating support for SmartScreen in Outlook and Exchange.

Content filtering evaluates inbound email messages by assessing the probability that the messages are legitimate or spam. Unlike other filtering technologies, the content filtering uses characteristics from a statistically significant sample of legitimate messages and spam to make its determination. Content filtering in Exchange Server is provided by the Content Filter agent, and is basically unchanged from Exchange Server 2010. Updates to the Content Filter agent are available periodically through Microsoft Update.

By default, the Content Filter agent is enabled on Edge Transport servers, but you can enable it on Mailbox servers. For more information, see Enable antispam functionality on Mailbox servers.

For more information about how to configure the Content Filter agent, see Content filtering procedures.

Using the Content Filter agent

The Content Filter agent assigns a spam confidence level (SCL) to each message by giving it a rating between 0 and 9. A higher number indicates that a message is more likely to be spam. Based on this rating, you can configure the agent to take the following actions:

  • Delete: The message is silently dropped without a non-delivery report (also known as an NDR, delivery status notification, DSN, or bounce message).

  • Reject: The message is rejected with an NDR.

  • Quarantine: The message is sent to the spam quarantine mailbox. For more information about the spam quarantine mailbox, see Spam quarantine in Exchange Server.

For example, you may decide that messages with an SCL rating of 7 or higher should be deleted, messages with an SCL rating of 6 should be rejected, and that messages with a SCL rating of 5 should be quarantined.

You can adjust the SCL threshold behavior by assigning different SCL ratings to each of these actions. For more information about how to adjust the SCL threshold to suit your organization's requirements, see Exchange spam confidence level (SCL) thresholds.

Note

Messages that are over 11 MB aren't scanned by the Intelligent Message Filter. Instead, they pass through the Content Filter agent without being scanned.

Allow phrases and Block phrases

You can customize how the Content Filter agent assigns SCL values by configuring custom words or phrases the agent will use to apply filter processing. Approved words or phrases are configured with Allow phrases, and unapproved words or phrases with Block phrases. When the Content Filter agent detects an Allow phrase in an inbound message, the agent automatically assigns an SCL value of 0 to the message. Alternatively, when the Content Filter agent detects a Block phrase in an inbound message, the agent assigns an SCL rating of 9. You can create up to 800 custom words or phrases in any combination of uppercase and lowercase letters. However, the case is ignored by the Content Filter agent.

Outlook Email Postmark validation

The Content Filter agent also includes Outlook Email Postmark validation. This validation is applied to outbound messages to help messaging systems distinguish legitimate email from spam, and to help reduce false positives. In spam filtering, a false positive occurs when a spam filter incorrectly identifies a legitimate message as spam. When Outlook Email Postmark validation is enabled, the Content Filter agent parses the inbound message for a computational postmark header. The presence of a valid, solved computational postmark header in the message indicates the client computer that generated the message solved the computational postmark, so the Content Filter agent is likely to lower the message's SCL rating.

Although computers don't require significant processing time to solve individual computational postmarks, processing postmarks for millions of spam messages will be prohibitive to a malicious sender. If a sender's message contains a valid, solved computational postmark, it's unlikely that the sender is malicious, so the Content Filter agent would lower the SCL rating. If the postmark validation feature is enabled and the computational postmark header in an inbound message is invalid or missing, the Content Filter agent won't change the SCL rating.

Bypassing the recipient, sender, and sender domain

In some organizations, all email messages to certain aliases must be accepted, which can cause problems if your organization manages a significant volume of spam. You can configure exceptions to content filtering for specific recipients, senders, and sender domains.

For example, a company named Woodgrove Bank has an alias named customerloans@woodgrovebank.com that provides email support to external loan customers, so the Exchange administrators configure Block phrases to filter messages that are typically used in spam sent by unscrupulous loan agencies. To prevent potentially legitimate messages from being rejected, the administrators set exceptions to content filtering by entering a list of recipient email addresses in the Content Filter agent configuration.

Safelist aggregation

Safelist aggregation is a set of antispam functionality that's shared across Outlook and Exchange. As its name suggests, it collects data from the antispam safe lists that Outlook users configure, and makes this data available to the antispam agents on the Exchange server. The Content Filter agent uses the Outlook Safe Senders Lists, Safe Recipients Lists, and trusted contacts to optimize spam filtering. Email messages from these contacts are identified as safe by the Content Filter agent. Sender filtering and the Sender Filter agent uses the Outlook Blocked Senders list to perform per-recipient sender filtering. For more information, see Safelist aggregation.

Configuring the Content Filter agent

You configure the Content Filter agent by using the Exchange Management Shell. For more information, see Content filtering procedures.

The Content Filter agent depends on updates to determine whether a message is spam. These updates contain data about phishing web sites, Microsoft SmartScreen spam heuristics, and other Intelligent Message Filter updates. These updates generally contain about 6 MB of data that's useful for longer periods of time than other antispam update data.

Content filter updates are available from Microsoft Update. The content filter update data is updated and available for download every two weeks.

Using the SCL value in mail flow rules on Edge Transport servers

On Edge Transport servers, the Edge Rule agent acts on messages before the SCL value is added by the Content Filter agent. If you want to use the SCLOver mail flow rule (also known as a transport rule) condition, you need to configure the Content Filter agent to run before the Edge Rule agent by changing the transport agent priorities. For more information, see Make message SCL values available to mail flow rules on Edge Transport servers.

Notes:

  • Although the Content Filter agent runs on other SMTP events, the SCL value is stamped on the message by the instance of the Content Filter agent that's registered on the OnEndOfData SMTP event.

  • If you configure the Content Filter agent to act on messages before the Edge Rule agent on an Edge Transport server, the server might incur additional processing costs, because messages that would normally be rejected by other mail flow rules are received and evaluated by the Content Filter agent before they are rejected by the Edge Rule agent. Also, you won't be able to configure a mail flow rule to stamp a message that has an SCL value of -1, which tells the Content Filter agent to ignore the message.

For more information about transport agents and transport agent priority, see Transport Agents in Exchange Server.