Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of my Exchange 2010 users is experiencing a high level of spam and I need to find a way to reduce it without creating a lot of false positives for everybody else.

Our environment consists of Exchange 2010 using Symantec Mail Security for spam filtering. Our filter was set to 72 but I just dropped it to 60 hoping that this will help some.

Short of that, what else can be done aside from purchasing new hardware/software solutions?

share|improve this question
up vote 0 down vote accepted

I use a product called PureMessage, which is part of the Sophos Small Business Suite. I find it reliable, very easy to install and configure and best of all you don't loose any e-mail if you don't want to. The system is capable of posting an e-mail to the mailbox in question, that will allow the mailbox owner to look at all of the SPAM that's been quarantined. I've found it to be extremely effective, with very few false positives in evidence. I've used Symantec products in the past and found them wanting, but that's just my preference.

On the 'What else' front, have a look at your mail server logs. It's relatively easy to see the IP addresses of the Internet nodes that have been hammering you. In PureMessage, and it's probably true of Symantec Mail Security too, filters can be put in place to ensure that unwanted senders don't get connected to your server in the first place. It's more of a problem for bigger companies, but we only deal with UK based firms, so anyone slamming our networks from a network in China, Russia or the far-east can be dealt with very easily: Block them! You'll find that the vast majority of SPAM comes from obviously dodgy parts of the world that you don't do business with anyway. Blocking them, and the IP Address range of the networks they are on, will cut down your SPAM dramatically.

share|improve this answer
Where would I find the logs that would indicate the IP addresses that we've been receiving email from? Ideally I'd like to be able to search for a specific email and find the IP from that. – Windows Ninja Mar 13 '12 at 19:06
I believe I located the logs at Exchange Management Console > Tracking Log Explorer...trying to find the IP from that. – Windows Ninja Mar 13 '12 at 19:15
I've got the exchange logging to an SQL database, but the same data is availble on file if it's being maintained. If you go to the Exchange System Manager, then have a look at the default SMTP Server properties, the location for the log files is defined there. – Tom Mar 14 '12 at 15:31
Having obtained the IP address, I then look at the address range that it's sitting on using a whois server is a good one. You have to be a little careful or you'll block out a legitimate network source. You can't block out Google just because one of their customers is a nurt. If you look up the range and find that the ISP that owns it is in deepest darkest Mongolia, and assuming that you don't actually have any clients in that part of the world, then you are probably safe blocking out the entire range. – Tom Mar 14 '12 at 15:38

Options include:

  1. Change the user's e-mail address.
  2. Train the user to configure the client-side junk mail filter in Outlook.
  3. Add a 3rd-party anti-spam relay service like MXLogic and point your company's MX records there.
share|improve this answer

To add on to changing the email address make sure the SPAM solution knows about all the user's aliases. For example the SPAM filter may block for, but not because it is not aware of it. I had this issue with Postini in the past.

share|improve this answer

Perhaps the simplest solution would be to install a client-side spam filter. That way this user would be able to adjust their own spam filter settings, without affecting the rest of the company.

I'm not familiar with specific capabilities of Symantec Mail Security. If you can, enable user-specific message quarantine, so that even if your spam-filtering is overly aggressive, users can still recover false-positives.

If this user has an easily guessable email address, such as mike@domain, perhaps they should start migrating to a new, more unique email address.

(Depending on your organization's policy, allow this user to forward their emails to gmail and utilize gmail's spam filter? :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.