Do you know a good (and free, if possible) Microsoft Exchange 2003 spam filter?
If you don't mind an outsourced service, you may be able to use Safentrix as a gated filtering solution. They claim free service that scales up to 20,000 users. I have not tried this service, so your mileage my vary.
There are a slew of other paid gating services that you can use to filter your incoming mail such as MX Logic (have heard good things about them).
We find that properly configured DNS/Realtime Black List (DNSBL/RBL) works wonders, part of the Intelligent Message Filter in Exchange 2003. We use:
- SpamHaus SBL+XBL+PBL: http://www.spamhaus.org/
- SORBS Dynamic IP Address Block List: http://www.sorbs.net/
See this article for how to configure it in Exchange 2003.
There's an article which provides a overview of some solutions to that issue.
I've had a lot of trouble with GFI and spam assassin. Both are good products but lack any decent detection rates. And depending on your setup (especially with multiple servers) you'll run into a lot of config problems. (Though GFI support is really on the ball - I was able to report bugs and get a workaround and then working fix within a week.)
What I ended up doing was going with the now google owned Postini and I haven't looked back. It "just works" (you set your MX records to them and reject email not from their servers in your firewall) and is very powerful and you can get it as low as $1.50 a mailbox.
You get a quarantine email at the end of the day with a list of subjects it picked up and you can just click deliver next the email you want. It also filters out "blatant spam" that doesn't even hit your quarantine. My company used to get sever hundred spam messages a day per mail box (about 40 boxes) and where GFI would catch about %75 of them, postini catches much closer to %99.
Dealing with spam used to take up a lot of my time, now Its rare when I get complaints about it in a week.
You could consider putting Hermes, a transparent SMTP proxy in front of Exchange. It is open source.
It filters out the blatant spam at the SMTP level, so the crap is not even coming into your site.
Free Exchange server-side spam filter appliance built on VMWare, with install videos.
SpamAssassin is quite the powerful product and works extremely well when configured correctly. That being said, to get a working implementation, you'll need to know a little bit about at least one distirbution of Linux and working with Config files. SpamAssassin comes pre-packaged with 20 configured DNSRBL servers and works for about 33% of my spam. The rest gets caught and/or killed by combining SpamAssassin Bayesian filtering, DCC, Pyzor and Razor2. Rather than using a quarantine box, I find it easier, in my small orgainziation, to simply tag the messages as SPAM and have them deliver to a separate folder using a rule on the mailbox server.
While there are a number of ways to configure SpamAssassin, it's most highly effective when glued together with ClamAV using Amavisd.
A good tutorial on how to do this is available at HowToForge.net here - http://www.howtoforge.com/virtual_postfix_mysql_quota_courier.
You can copy and paste most of it, but read through it carefully because there are a few server specific changes you will need to make.
Although it isn't free, ORF from www.vamsoft.com is licensed per server. So in my environment of 300 mailboxes, it is much more affordable to pay $239 to protect everyone as opposed to the big guys who usually want $10-$30 per mailbox.
As far as functionality, it works really well for us. They have a best practices guide on setting it up, I set it up to use 3 of the most popular DNSBL, 2 of the most popular URI based filtering, a couple other minor tweaks, and it catches most of the spam sent to us.
I'm sure Postini and some of the other big guys have better ratios, but I'm very happy with the price versus the results.
I have only had excelllent results with SPAMfighter's solution for Exchange spam. GFI was also good but a little on the expensive side for 25 mailboxes.