Exchange Compatible Spam Filters?

DamienMcKenna asks: "At work our license for Symantec Brightmail is coming up for renewal and I'm looking for alternatives that will cooperate with Microsoft Exchange 2003. Brightmail hasn't worked consistently since we installed it last year, has a low success rate, the client plugin has been very unstable, and it takes up far too much server resources for what it does. Given that many of the appropriate software is not available for trial (you have to base decisions off their marketing materials), does anyone have recommendations on what to use instead? It must be Windows-based (UNIX/Linux/BSD is out of the question right now), and should have an easy to use administrative interface since not all of the IT staff are very technically minded. A working plugin for Outlook for client-level configuration would also be appreciated."

"Not technically minded?"

[W2k]

If your IT staff is not technically minded, you have bigger problems than SPAM. Maybe it's just me, but I was under the distinct impression that the foremost qualification necessary to join the IT staff of any self-respecting company is to be technically minded. What are those people doing there if they can't do their jobs?

What kind of a "company" is this? I guess it's too much to ask for a name.

ORFEE

[ReverendRyan]

I've had good luck with ORFEE [vamsoft.com]. After implementing the Greylist, our spam went down about 75%. I then blacklisted the remaining spam-sending networks (only if I knew we wouldn't need to mail them) and it has now been several weeks since I've received a single piece of spam.

It doesn't have an outlook plugin, but we haven't really needed one. It also has a trial version.

McAfree GroupShould with SpamKiller add-on

[hawkbug]

McAfee is what my company uses on our Exchange server. I'm a linux guy, so I'm familar SpamAssassin and I use SA on my linux mail servers. However, since SA isn't available for windows, I did some research and discovered that McAfee created a product call SpamKiller, which uses SpamAssassin as it's base, and they basically create hooks into Exchange for it. SpamAssassin is currently up to version 3.1.1, and from what I understand, the McAfee product is still using the 2.X base for their code, but it does work OK. SA does a slightly better job since it's more up to date, but with McAfee's nightly antivirus updates, you also get an updated spamfilter settings and code. I'd give it OK marks and definitely suggest using it:

http://www.mcafee.com/us/smb/products/anti_spam/sp amkiller_mail_servers.html [mcafee.com]

Two suggestions - Gateway products

[bernywork]

Your best bet if you want to not care if it's Exchange or anything else, go for a gateway product.

1) If you want to house on site, then use this: Trend Micro InterScan Messaging Security Suite [trendmicro.com] It runs on windows, and has a really good hit rate for SPAM and it's even better with viruses.

2) If you don't mind getting someone else to do it for you: MessageLabs Spam and Virus filtering [messagelabs.com]

The IMSS solution I am not going to turn around to you and say that it's the absolute best thing on the face of the planet, as quite simply I just haven't seen something out there yet, that really makes me go WOW! It is however, a really good gateway product, and works extremely well, if nothing else, it's the pick of a bad bunch. It's very configurable, and in from my experiences with it, tends not to screw up. That's a pretty important factor for me.

The MessageLabs solution is another gateway solution. It's not housed by you, so it takes up no server resources on your part, and the solution is extremely redundant. Certainly a hell of a lot more than you are going to get paying for it yourself in most instances. Their virus and spam definitions are essentially second to none, and the rates of false positives I have seen for spam are very good as well. Their interface on their web site isn't exactly feature rich, in actual fact it really is quite sparse, but then it does cover the basics, and their retention times for bad mails are good too.

So for gateway products, these are what I am recommending to customers at the moment. I am tending to not push for server based (Exchange server / Information Store) AV as hardware is cheap and if it's not on there it can't cause you any problems. All this tied in with the fact that it doesn't scale leads me to think that it's not worth it. The other suggestion would be to run Exchange on port 26 and have this on port 25. That way it can be on the same box, but it shouldn't interfere with Exchange at all.

I have no idea what your discount schedule is for resellers, so I can't even get you indicitive pricing. I also don't know where you are, so that helps me even less.

Happy hunting!

Berny

We love brightmail

[Anarke_Incarnate]

at work. However, have you considered instead of using brightmail on the exchange server, only use the foldering agent and set up brightmail filters as your MX record (top level) and have them relay the mail to your exchange? We have about >95% catch rate. You can set them up running on Windows with IIS SMTP, Linux with sendmail or Solaris with sendmail. As cheap as brightmail is and as good as it has worked for my company, I would keep it. My suggestion would be to use the "Suspected Spam" option and set the threshold to 62. The one thing I would suggest is if it is a windows based gateway filter, as described above, reboot it weekly (works really well if you can afford 2 boxes, since BM doesn't charge by server, CPUs or anything, but rather how many clients you have it filter for) or at least schedule scripts to restart tomcat (net stop tomcat... net start tomcat...) If on a *Nix box, just cron tomcat restarts.

Re:MailMarshal

[m0rph3us0]

I know of a company Global Relay [globalrelay.com] that offers a hosted spam/virus filter for Exchange. They also do Email archiving so that in the event of disaster your company still has access to all its email. Their mail systems are so good that they've never lost a single email in 6 years. The Chicago Stock Exchange uses their services so they are well prepared for larger organizations.