{"id":629,"date":"2006-08-02T12:23:00","date_gmt":"2006-08-02T12:23:00","guid":{"rendered":"http:\/\/markwilson.me.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm"},"modified":"2007-09-13T00:57:49","modified_gmt":"2007-09-12T23:57:49","slug":"controlling-spam-using-microsoft","status":"publish","type":"post","link":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm","title":{"rendered":"Controlling spam using the Microsoft Exchange intelligent message filter"},"content":{"rendered":"<p><!--115452271253715682-->It may just be a co-incidence, but since <a href=\"https:\/\/www.markwilson.co.uk\/blog\/2006\/05\/migrating-smtp-e-mail-from-my-isps.htm\">I switched my e-mail from my ISP&#8217;s servers to my own server<\/a> a few months back, I&#8217;ve been seeing a huge increase in the amount of unsolicited commercial e-mail (UCE) &#8211; commonly known as spam &#8211; in my mailbox.<\/p>\n<p>At the time of writing, <a href=\"http:\/\/www.messagelabs.com\/StatisticsThreat\/StatisticsThreatType=Spam\">statistics from MessageLabs show a decline in the volumes of spam over the last 12 months<\/a> (although they still indicate that 58.39% of all e-mails sent were spam). <a href=\"http:\/\/www.postini.com\/stats\/\">Postini&#8217;s statistics<\/a> suggest that 73% of e-mail is spam.<\/p>\n<p>If you think those statistics are bad, according to Microsoft, Bill Gates receives 4 million spam messages a day, making him probably the most spammed man in the world (it&#8217;s no surprise then that he is rumoured to have his own mail server at Microsoft).<\/p>\n<p>Any effective strategy for dealing with UCE (specifically for Exchange Server 2003, but the generic advice is the same for all mail servers) needs to operate a multiple levels within the e-mail transport (these are defined on the Message Delivery Settings under Global Settings in Exchange System Manager but need to be imposed using the properties for each SMTP virtual server):<\/p>\n<ul>\n<li>Server-level accept\/deny lists can be used to always accept, or always deny, messages from certain domains. The trouble with this method of trapping e-mail is that I occasionally receive non-delivery reports (NDRs) for messages that were allegedly sent from markwilson.co.uk but that actually never came near my servers, so without a real-time DNS lookup mechanism to verify the sender&#8217;s domain (such as Sender ID), these are of limited use.<\/li>\n<li>Connection filtering using real-time block lists (RBLs) is the next level of protection, using a DNS query against a RBL provider&#8217;s servers, such as <a href=\"http:\/\/www.spamhaus.org\/\">the SpamHaus project<\/a>.<\/li>\n<li>Sender filtering can be used to drop any messages that claim to come from a particular e-mail address, optionally archiving them.<\/li>\n<li>Recipient filtering is a method of rejecting certain e-mail addresses (e.g. for people who have left the organisation, or for non-existent addresses). One option is to filter messages for recipients who are not in the directory; however this can leave an organisation open to a directory harvest attack as the server gives different responses for valid and invalid addresses. To avoid such attacks, a &#8220;tarpit&#8221; (see <a href=\"http:\/\/support.microsoft.com\/?kbid=842851\">Microsoft knowledge base article 842851<\/a>) can be employed, to delay responses to bad addresses by a few seconds, slowing down any directory harvest attacks significantly (it would normally be possible to harvest all four-character address combinations within a few minutes &#8211; with a 5 second tarpit delay this is increased to a couple of months &#8211; and most addresses have much longer aliases than 4 characters).<\/li>\n<li>Finally, the <a href=\"http:\/\/www.microsoft.com\/technet\/prodtechnol\/exchange\/downloads\/2003\/imf\/\">intelligent message filter<\/a> (IMF &#8211; previously a separate download but now included with <a href=\"https:\/\/www.markwilson.co.uk\/blog\/2005\/10\/exchange-server-2003-sp2-is-now.htm\">Exchange Server service pack 2<\/a>) employs a Microsoft-proprietary algorithm (SmartScreen) to scan each message and mark it with a spam confidence level (SCL), which is then used to process the mail accordingly at the gateway or mailbox level.<\/li>\n<\/ul>\n<p>Each of these tools filters out less obvious types of UCE with increasing levels of cost in terms of server resource. Whilst the junk e-mail filters in Outlook 2003\/2007 and Entourage 2004, which are also based on SmartScreen but doesn&#8217;t use the SCL mechanism, are pretty good at filtering messages, they are far from perfect (in my experience, Outlook seems to be better at this than Entourage). Activating the IMF on my server has provided an additional level of filtering which has greatly reduced the volume of UCE making it through as far as my mailbox.<\/p>\n<p>The IMF uses 11 SCL ratings, set as an attribute in the message header:<\/p>\n<ul>\n<li>-1 is used for messages submitted internally with an authenticated connection &#8211; eliminating false positives for internal e-mail.<\/li>\n<li>0 is used for messages that are marked as not spam.<\/li>\n<li>1-9 are used to highlight varying levels of probability that a message is spam (9 being the most likely).<\/li>\n<\/ul>\n<p>Within Exchange, the SCL value can be used to filter UCE on gateway servers as well as with a lower level SCL used by the information store to move messages to the user&#8217;s junk e-mail folder &#8211; therefore allowing for the most obvious UCE to be trapped at the gateway (least chance of false positives) and for users to retrieve any messages in the mid-range that are incorrectly marked as junk. The gateway blocking action is also configurable &#8211; with options for archival, deletion (without NDR), no action, or rejection.<\/p>\n<p>Archived messages will be saved (by default) to %programfiles%\\Exchsrvr\\Mailroot\\vsi 1\\UCEArchive. Each message is archived as an .EML file, which can be viewed with a text editor. To resubmit a message for delivery it can simply be moved to the corresponding %programfiles%\\Exchsrvr\\Mailroot\\vsi 1\\Pickup folder. Obviously, viewing individual messages in a text file is time-consuming and the <a href=\"http:\/\/workspaces.gotdotnet.com\/imfarchive\">IMF Archive Manager<\/a> is a great tool for managing IMF-archived messages.<\/p>\n<p>The SCL at which to block messages for a particular organisation will vary according to the profile of e-mail sent to\/from the organisation &#8211; I have my SCL level for gateway blocking set to 7 with archiving enabled and so far I have only had one false positive &#8211; but clearly for organisations receiving more e-mail than I do, this will be a bigger issue! At the store level (set to move messages with an SCL greater than 4) things are not working quite so well but that is to be expected as in the grey area between good and bad mail, some legitimate (good) messages will inevitably get marked with the same SCL as the (bad) UCE. It&#8217;s worth noting that marking a sender as safe in Outlook will only override the SCL at the mailbox-level &#8211; it has no effect at the gateway.<\/p>\n<p>To assist in judging the SCL levels to use for filtering, it is possible to <a href=\"http:\/\/msexchangeteam.com\/archive\/2004\/05\/26\/142607.aspx\">expose the SCL in Outlook<\/a> and in <a href=\"http:\/\/msexchangeteam.com\/archive\/2004\/05\/27\/143297.aspx\">Outlook Web Access<\/a> (OWA). Also useful may be (temporarily) enabling diagnostic logging on the MSExchangeTransport\\SMTP Protocol for a server, such that SMTP events are logged. Performance monitor counters from the MSExchange Intelligent Message Filter object can also be used to log the amount of spam filtered or acted upon, the relative SCL levels and overall IMF performance. Based on the performance monitor data, the IMF gateway blocking configuration can be reduced from no action to archive, and then finally (once confident that the levels are correct) to delete, as the appropriate SCL levels are determined.<\/p>\n<p>It&#8217;s also possible to mark the SCL on archived messages by creating an new registry key called <span style=\"font-family: courier new\">ContentFilter<\/span> at HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Exchange\\ and a corresponding DWORD value named <span style=\"font-family: courier new\">ArchiveSCL<\/span> set to <span style=\"font-family: courier new\">1<\/span>. A string value named <span style=\"font-family: courier new\">ArchiveDir<\/span> can also be used to change the archive folder. Both of these settings are detailed in the <a href=\"http:\/\/www.microsoft.com\/technet\/prodtechnol\/exchange\/guides\/IMF_SP2\/78dae136-9600-4f2c-87d3-381448f888df.mspx?mfr=true\">Microsoft Exchange Server TechCenter<\/a> along with details for applying the IMF to trusted (authenticated) connections and increasing the size limit for the rule used to process spam at mailbox level (allowing more blocked and safe senders).<\/p>\n<p><strong>Suggested further reading<\/strong><br \/>\nIMF release notes (<a href=\"http:\/\/support.microsoft.com\/?kbid=867633\">Microsoft knowledge base article 867633<\/a>).<br \/>\n<a href=\"http:\/\/support.microsoft.com\/?kbid=867633\">Microsoft Exchange Team Blog<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It may just be a co-incidence, but since I switched my e-mail from my ISP&#8217;s servers to my own server a few months back, I&#8217;ve been seeing a huge increase in the amount of unsolicited commercial e-mail (UCE) &#8211; commonly known as spam &#8211; in my mailbox. At the time of writing, statistics from MessageLabs &hellip; <a href=\"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Controlling spam using the Microsoft Exchange intelligent message filter<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[],"tags":[46,10],"class_list":["post-629","post","type-post","status-publish","format-standard","hentry","tag-exchange","tag-spam"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Controlling spam using the Microsoft Exchange intelligent message filter - markwilson.it<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Controlling spam using the Microsoft Exchange intelligent message filter - markwilson.it\" \/>\n<meta property=\"og:description\" content=\"It may just be a co-incidence, but since I switched my e-mail from my ISP&#8217;s servers to my own server a few months back, I&#8217;ve been seeing a huge increase in the amount of unsolicited commercial e-mail (UCE) &#8211; commonly known as spam &#8211; in my mailbox. At the time of writing, statistics from MessageLabs &hellip; Continue reading Controlling spam using the Microsoft Exchange intelligent message filter\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm\" \/>\n<meta property=\"og:site_name\" content=\"markwilson.it\" \/>\n<meta property=\"article:published_time\" content=\"2006-08-02T12:23:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2007-09-12T23:57:49+00:00\" \/>\n<meta name=\"author\" content=\"Mark Wilson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@markwilsonit\" \/>\n<meta name=\"twitter:site\" content=\"@markwilsonit\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark Wilson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm\"},\"author\":{\"name\":\"Mark Wilson\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"headline\":\"Controlling spam using the Microsoft Exchange intelligent message filter\",\"datePublished\":\"2006-08-02T12:23:00+00:00\",\"dateModified\":\"2007-09-12T23:57:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm\"},\"wordCount\":1194,\"commentCount\":6,\"publisher\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"keywords\":[\"Microsoft Exchange\",\"Spam\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm\",\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm\",\"name\":\"Controlling spam using the Microsoft Exchange intelligent message filter - markwilson.it\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#website\"},\"datePublished\":\"2006-08-02T12:23:00+00:00\",\"dateModified\":\"2007-09-12T23:57:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2006\\\/08\\\/controlling-spam-using-microsoft.htm#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Controlling spam using the Microsoft Exchange intelligent message filter\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/\",\"name\":\"markwilson.it\",\"description\":\"get-info -class technology | write-output &gt; \\\/dev\\\/web\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\",\"name\":\"Mark Wilson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"width\":800,\"height\":800,\"caption\":\"Mark Wilson\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\"},\"description\":\"A Chartered IT Professional, with recent experience in technology leadership, IT strategy and practice management roles, Mark Wilson is an Enterprise Architect in the Advisory and Management Group at risual. During a career spanning more than two decades, Mark has gained widespread recognition as an expert in his field including both industry and national press exposure. In addition to certifications from Microsoft, VMware, Red Hat, The Open Group and Axelos, Mark held a Microsoft Most Valuable Professional (MVP) award for three years and is now part of the MVP Reconnect programme. Mark is also well-known on social media and maintains an award-winning blog.\",\"sameAs\":[\"http:\\\/\\\/www.markwilson.co.uk\\\/\",\"https:\\\/\\\/www.instagram.com\\\/markwilsonuk\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/markawilson\\\/\",\"https:\\\/\\\/x.com\\\/markwilsonit\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCWHlZCoHRTocdvtrOJ2IL4A\"],\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/author\\\/mark-wilson\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Controlling spam using the Microsoft Exchange intelligent message filter - markwilson.it","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm","og_locale":"en_GB","og_type":"article","og_title":"Controlling spam using the Microsoft Exchange intelligent message filter - markwilson.it","og_description":"It may just be a co-incidence, but since I switched my e-mail from my ISP&#8217;s servers to my own server a few months back, I&#8217;ve been seeing a huge increase in the amount of unsolicited commercial e-mail (UCE) &#8211; commonly known as spam &#8211; in my mailbox. At the time of writing, statistics from MessageLabs &hellip; Continue reading Controlling spam using the Microsoft Exchange intelligent message filter","og_url":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm","og_site_name":"markwilson.it","article_published_time":"2006-08-02T12:23:00+00:00","article_modified_time":"2007-09-12T23:57:49+00:00","author":"Mark Wilson","twitter_card":"summary_large_image","twitter_creator":"@markwilsonit","twitter_site":"@markwilsonit","twitter_misc":{"Written by":"Mark Wilson","Estimated reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm#article","isPartOf":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm"},"author":{"name":"Mark Wilson","@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"headline":"Controlling spam using the Microsoft Exchange intelligent message filter","datePublished":"2006-08-02T12:23:00+00:00","dateModified":"2007-09-12T23:57:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm"},"wordCount":1194,"commentCount":6,"publisher":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"keywords":["Microsoft Exchange","Spam"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm","url":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm","name":"Controlling spam using the Microsoft Exchange intelligent message filter - markwilson.it","isPartOf":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#website"},"datePublished":"2006-08-02T12:23:00+00:00","dateModified":"2007-09-12T23:57:49+00:00","breadcrumb":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.markwilson.co.uk\/blog\/2006\/08\/controlling-spam-using-microsoft.htm#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.markwilson.co.uk\/blog"},{"@type":"ListItem","position":2,"name":"Controlling spam using the Microsoft Exchange intelligent message filter"}]},{"@type":"WebSite","@id":"https:\/\/www.markwilson.co.uk\/blog\/#website","url":"https:\/\/www.markwilson.co.uk\/blog\/","name":"markwilson.it","description":"get-info -class technology | write-output &gt; \/dev\/web","publisher":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.markwilson.co.uk\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":["Person","Organization"],"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468","name":"Mark Wilson","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","url":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","width":800,"height":800,"caption":"Mark Wilson"},"logo":{"@id":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1"},"description":"A Chartered IT Professional, with recent experience in technology leadership, IT strategy and practice management roles, Mark Wilson is an Enterprise Architect in the Advisory and Management Group at risual. During a career spanning more than two decades, Mark has gained widespread recognition as an expert in his field including both industry and national press exposure. In addition to certifications from Microsoft, VMware, Red Hat, The Open Group and Axelos, Mark held a Microsoft Most Valuable Professional (MVP) award for three years and is now part of the MVP Reconnect programme. Mark is also well-known on social media and maintains an award-winning blog.","sameAs":["http:\/\/www.markwilson.co.uk\/","https:\/\/www.instagram.com\/markwilsonuk\/","https:\/\/www.linkedin.com\/in\/markawilson\/","https:\/\/x.com\/markwilsonit","https:\/\/www.youtube.com\/channel\/UCWHlZCoHRTocdvtrOJ2IL4A"],"url":"https:\/\/www.markwilson.co.uk\/blog\/author\/mark-wilson"}]}},"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":378,"url":"https:\/\/www.markwilson.co.uk\/blog\/2006\/10\/implementing-real-time-block-lists-for.htm","url_meta":{"origin":629,"position":0},"title":"Implementing real time block lists for spam control","author":"Mark Wilson","date":"Friday 6 October 2006","format":false,"excerpt":"A couple of months back, I wrote a post about controlling spam using the Microsoft Exchange Intelligent Message Filter. Whilst it has to be said that the IMF has been effective in reducing my spam volumes (with very low false positives - strangely enough my blog posts are the ones\u2026","rel":"","context":"In \"Microsoft Exchange\"","block_context":{"text":"Microsoft Exchange","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/exchange"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":70,"url":"https:\/\/www.markwilson.co.uk\/blog\/2005\/03\/new-face-of-spam.htm","url_meta":{"origin":629,"position":1},"title":"The new face of spam","author":"Mark Wilson","date":"Friday 18 March 2005","format":false,"excerpt":"We are all used to spam arriving in our e-mail inboxes, but now the problem is spreading to other communications methods. Research by Wireless Services Corporation shows almost half of the mobile phone text messages received in the US are spam, compared with 18% a year ago. Another problem is\u2026","rel":"","context":"In \"E-mail\"","block_context":{"text":"E-mail","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/e-mail"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":624,"url":"https:\/\/www.markwilson.co.uk\/blog\/2006\/10\/message-hygiene-principles-for.htm","url_meta":{"origin":629,"position":2},"title":"Message hygiene principles for Microsoft Exchange Server","author":"Mark Wilson","date":"Tuesday 3 October 2006","format":false,"excerpt":"Whilst researching my post on the Microsoft Exchange intelligent message filter a couple of months back, I came across the following message hygiene architectural principles, which Microsoft promotes as best practice: Anti-spam filtering must be performed before anti-virus filtering. Anti-spam filtering should be performed for inbound mail only. Anti-spam filtering\u2026","rel":"","context":"In \"Malware\"","block_context":{"text":"Malware","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/malware"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":829,"url":"https:\/\/www.markwilson.co.uk\/blog\/2007\/07\/implementing-senderid-framework-records-for-my-e-mail-server.htm","url_meta":{"origin":629,"position":3},"title":"Implementing SenderID Framework records for my e-mail server","author":"Mark Wilson","date":"Friday 6 July 2007","format":false,"excerpt":"I recently read Craig Spiezle and Alexander Nikolayev's TechNet Magazine article about the SenderID Framework (SIDF) - one of the available schemes to validate mail servers in the fight to reduce unsolicited commercial e-mail (UCE), more commonly known as spam. SIDF is similar to the Sender Policy Framework (SPF) in\u2026","rel":"","context":"In \"DNS\"","block_context":{"text":"DNS","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/dns"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":10,"url":"https:\/\/www.markwilson.co.uk\/blog\/2004\/08\/tackling-spam-in-exchange-with-regex.htm","url_meta":{"origin":629,"position":4},"title":"Tackling spam in Exchange with the RegEx SURBL","author":"Mark Wilson","date":"Monday 23 August 2004","format":false,"excerpt":"Last week, I read an interesting e-mail from the Windows and .NET magazine network Exchange and Outlook update, discussing Spam URL Realtime Block Lists (SURBLs), which examine message contents to block spam. This week's e-mail highlights a free Exchange Server SURBL - the RegEx filter. The basic idea behind the\u2026","rel":"","context":"In \"Microsoft Exchange\"","block_context":{"text":"Microsoft Exchange","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/exchange"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2746,"url":"https:\/\/www.markwilson.co.uk\/blog\/2011\/06\/office-365-message-filtering-and-a-horrible-little-bug-that-leaves-email-addresses-exposed.htm","url_meta":{"origin":629,"position":5},"title":"Office 365 message filtering (and a horrible little bug that leaves email addresses exposed&#8230;)","author":"Mark Wilson","date":"Wednesday 1 June 2011","format":false,"excerpt":"One of my concerns with my recent switch from Google Apps Mail to Microsoft Office 365 was about spam email. You see, I get none. \u00a0Well, when I say I get none, I get plenty but it's all trapped for me. With no effort on my part. Only a handful\u2026","rel":"","context":"In &quot;Technology&quot;","block_context":{"text":"Technology","link":"https:\/\/www.markwilson.co.uk\/blog\/topic\/technology"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts\/629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=629"}],"version-history":[{"count":0,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts\/629\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}