Working with Exchange 2007 Anti-Spam Reports

Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.

 

Applies to: Exchange Server 2007, Exchange Server 2007 SP1, Exchange Server 2007 SP2, Exchange Server 2007 SP3

There are seven reports that you can run in the Microsoft Exchange Server 2007 anti-spam or message hygiene reports group. The following is a brief explanation of each report.

Attached File Filter

The Attached File Filter Report shows the effectiveness of the Attachment Filter agent. This agent filters messages based on attachment file name, file name extension, or file MIME content type. You can configure this agent to block a message and its attachment, to strip the attachment and allow the message to pass through, or to silently delete the message and its attachment.

Connection Filter Report

The Connection Filter Report shows the effectiveness of the Connection Filter agent. This agent filters messages based on the IP address of the remote server from which a message is sent. A variety of IP Block lists and IP Allow lists and optional services are used to determine what action, if any, to take on a particular message based on its source IP address. You can see statistics for connection-allowed results for all included computers over time or view the results by computer.

Content Filter

The Content Filter Report shows the effectiveness of the Content Filter agent. This agent uses Microsoft SmartScreen technology to assess the contents of a message. The Exchange Intelligent Message Filter is based on patented machine learning technology from Microsoft Research. The Intelligent Message Filter learns distinguishing characteristics of legitimate e-mail and of spam. Based on these characteristics, the Intelligent Message Filter helps determine whether an incoming message is spam or legitimate e-mail.

Note

On November 1, 2016, Microsoft stopped producing spam definition updates for the SmartScreen filters in Exchange and Outlook. The existing SmartScreen spam definitions will be left in place, but their effectiveness will likely degrade over time. For more information, see Deprecating support for SmartScreen in Outlook and Exchange.

Protocol Analysis

The Protocol Analysis Report shows the effectiveness of the Protocol Analysis/Sender Reputation agent. The Sender Reputation agent is an anti-spam agent that is enabled on computers that are running Exchange 2007 that have the Edge Transport server role installed. The Sender Reputation agent can block messages according to many characteristics of the sender. The Sender Reputation agent relies on persisted data about the sender to determine what action, if any, to take on an inbound message. Sender reputation functionality is also referred to as protocol analysis.

Recipient Filter

The Recipient Filter Report shows the effectiveness of the Recipient Filter agent. This agent compares the recipients that are identified in the RCPT TO: SMTP header to known recipients identified in list of blocked recipients and to the local recipient directory which stores valid recipients that exist inside the organization. The Recipient Filter agent makes this comparison to determine what action, if any, to take on a particular message.

Sender Filter

The Sender Filter Report shows the effectiveness of the Sender Filter agent. This agent compares the sender identified in the MAIL FROM: SMTP header to known senders identified in an IP Block list. The Sender Filter agent makes this comparison to determine what action, if any, to take on a particular message.

Sender Id

The Sender Id Report shows the effectiveness of the Sender Id agent. This agent relies on the RECEIVED: SMTP header and a query to the sending system's DNS service to determine what action, if any, to take on a particular message.