Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are in the process of implementing Exchange 2010 for 60 users. I would like to know what others are using for spam filtering/email security for Exchange. I am looking at two options: Microsoft Threat Management Gateway (TMG) or Symantec Bright mail Gateway. If you are using the same or any other options please share your feedback/comments..

Thank you in advance for any replies…

Regards, Hemal

share|improve this question

closed as not constructive by Shane Madden, Ben Pilbrow, Scott Pack, RobM, Holocryptic Jun 4 '11 at 21:22

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

TMG used for SMTP is about border/connection protection and has no spam filtering (without 3rd party add-ins).

Built in spam protection is decent but for all my installs I recommend Forefront Protection 2010 for Exchange which does all the spam and AV filtering needs.

Rather then Forefront onsite you can also outsource it to Microsoft

For connection protection I recommend using built-in Edge role on a separate box, or your previously mentioned TMG in front of the hub (i.e. you don't need both edge and TMG)... but in your smaller scenario, TMG is likely an unnecessary expense unless you also plan to go SharePoint, Lync, and go "all in" with the Microsoft products... that's where TMG really shines.

But to that point, I would defiantly recommend (but not require) putting something in front of the hub role, be it either Forefront hosted (you block all IP's but Microsoft's at your FW), or TMG, or edge role, or Google's Postini like KCotreau which I've also used.

Let us know what you go with and why.

share|improve this answer
Thank you very much for your reply Bret. Now I will have to find the best option. Will definitely post it here which way we are going.. Thank you again.. – Hemal Jun 3 '11 at 15:23

Considering the cost is almost a wash compared to local software, here is something to consider:

Get Google's Postini service: It works very well in my experience. First, you get all the SPAM and virus filtering you need both inbound and outbound. Second, if you do not have a second mail server, it gives you 4 MX records, so if your server goes down, when it comes back up, all the mail gets delivered, and nothing was lost. Lastly, after you have it set up, you can set your firewall to ONLY accept incoming SMTP port 25 traffic from Google's servers, so you face less chances of being attacked by spammers trying to somehow find a hole in your server to relay through.

I would also recommend that you use a reseller rather than going directly to Google, if possible. If you have any setup issues, they are more accessible, and probably know the product well.

share|improve this answer
We are getting ready to test Postini. The cost is negligible vs the cost of local mgmt and users can be given access to release false positives. – uSlackr Jun 3 '11 at 15:06
Thank you buddies for reply. I will also look this option.. Am glad post the question. Got so many ideas... Thanks again... – Hemal Jun 3 '11 at 15:24

We use a Mailcleaner smarthost in our DMZ and it works quite well. It's a free distro that bundles a bunch of good open source tools (Exim, SpamAssassin, ClamAV, Razor, Pyzor etc) and puts a very friendly web-based management tool on it. We migrated from Exchange to Zimbra for our mail server a while back, but using Mailcleaner as a mail gateway has worked extremely well for both.

Technically the current version is still labeled as 'beta 3', but it has been at that stage for over a year and is stable and works well.

As a complete distro, it requires a separate box or VM, but we've been running it happily as a KVM guest for a long time.

share|improve this answer

I've loved our Barracuda SPAM Filter that we've had for the best several years. It's a separate appliance, so they're a high up-front cost, but it's worked very well and been very reliable.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.