Messaging Gateway

Our users are complaining they aren't receiving enough email since Brightmail went live two days ago.  They're worried they're losing orders, etc.  Important considerations. I'm trying to clear up my confusion regarding how to best use Brightmail.  Here's our setup:

We're replaing GFI MailEssentials & MailSecurity with Brightmail v8  
We have one Exchange 2003 SP2 Server
I have one brightmail server and one GFI server in front of exchange, as inbound only relays.
Exchange is the outgoing email server.

All I want Brightmail to do is to of course scan incoming email for virus & spam, and perfom the following actions (i've configured it do to the following actions):

Spam:  deliver all spam and suspected spam to the "Junk E-Mail" folder in Outlook
Virus:  deliver all infected email to the brightmail quarantine

The virus side looks correct.  However, with the Spam side of things I'm getting a mixed bag.  SPAM is definitely being filtered, but no one seems to be getting anything in their Junk E-Mail folders.  This is highly suspicious as people here are very much used to getting spam in their spam folder. 

I've read about installing the Spam Agent from SMSMSE on the exchange server, and about SCL values (from premium antispam but those features are not visible in brightmail).  Any suggestions?

Zagat,


Please explain how you have set the spam to go to the Junk Mail folder.

If you have in fact set the current spam rule to simply add an SCL number with no other action, the message will be relayed to Exchange. Depending on what SCL number you told us to add, Exchange can take a number of actions. You would need to check Exchanges settings to see what action they are taking for which range. Here is a good article on how to do that:

http://www.petri.co.il/configure_imf_in_exchange_2003_sp2.htm

The "Spam or suspected spam: deliver to spam folder" policy is being applied to the default group. All users are members of the default group. 

The action in that group meets the criteria "if the email is spam or suspected spam", "deliver the message to the recipient's spam folder." 

There are no actions which allow me to set a SCL value in any of the available spam rules.  Exchange is set to Gateway Blocking "9 / No Action" and Store Junk Email Config "8." 

What I can't get clarification on is, in terms of Brightmail, what is "the recipient's spam folder" - I can't find a clear definition of what it is in any of the manuals or support (yet). :)  For example, If the spam folder is an SCL value, that's great, but where do I tell Brightmail what value to tag the emails with?

The only thing I see in the Brightmail Manuals is references to the Spam Agent from SMSMSE, and Symantec support says it is a non supported application; and even then, the manual doesn't describe how that process works or what mechanisms it uses so I'm back to square one.  How is this supposed to work?

The action you selected will add something to the message that will be caught by the Brightmail Outlook plugin. We have a document which describes a workaround, if you have the plugin, so it will deliver messages to the Junk folder. It is true that it is no longer supported but it still works. This will also give you the 'This is spam' button so you don't have to use the public folder workaround.


Title: 'How to forward spam emails from Symantec Mail Security Appliance to the Outlook 2003 Junk Folder'
Document ID: 2007101517395754
> Web URL: http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2007101517395754?Open&seg=ent

I forgot to mention, if you could, please post the feature request under 'Ideas' here to add the ability to add an SCL to a message for the Brightmail appliance?

It would help show our project managers that this is a wanted feature.

I should have been more clear, we use Outlook 2007 as our client.  I read the docs on the BMOP plugin and it stops at Outlook 2003 so I really don't think that's the best way to go.

You said Brightmail adds something to the message so the outlook plugin can detect it.  Is this something that SMSMSE can detect and make a decision on?

I use the BMOP on Outlook 2007 and it works fine for me. I have run into customers in the past who have had issues though, so you may want to test it

Here's a possible workaround:

Using the test spam detection string to have Mail Security for Exchange take action on spam coming from the Brightmail Appliance:

On the Brightmail appliance, go under the Compliance tab and add an annotation. Call it Spam String. In the plain text field, type: http://www.example.com/url-1.blocked

Edit the spam rule you have set up as your current rule (In Administration-> Groups-> Default-> Spam)

In the action to take select add an annotation and choose Spam String and choose Append.

Now every message detected as Spam will have the string at the end of it that will tell SMSMSE it is spam. In the SMSMSE settings, have it add the SCL to the message for Spam messages and do nothing for either Suspected Spam levels.

( I haven't had a chance to test this thoroughly, let me know how it works)

That sounds great, the only problem is on SMSMSE v6, it seems the Premium Antispam actions (1) aren't customizable meaning i can't create custom policies there to apply an scl when specific tags in the subject header  (2) premium antispam actions don't seem to run if premium antispam isn't enabled (3) i don't want the exchange server actually doing the spam scanning, it is busy enough. :)

Also, if I try and use Content Filtering Rules, there are only 5 possible actions:  delete entire message, delete attachments in message, quarantine, replace, add a tag to beginning of subject line, or log only.  Basically I can't create a rule with to match any string and assign a SCL to it.

I'm kinda "over" trying to make the user experience as similar to (or simpler than) GFI as possible and unfortunately will just accept this as-is and with Brightmail just tag all spam & suspected spam with [SPAM] in the subject line and continue to use the GFI Rules Wizard on exchange to deliver to the Junk E-Mail folder that way.  I realize that will bring about mixed results (clicking the not junk button won't always make an email be delivered to the inbox in outlook) but it's better than nothing.  At this point i'm just happy to be off GFI and will retrain the users. 

My only wish is that Brightmail would just put the SCL in the message so Exchange could do its thing without the overhead of rules and additional scanning.  If that wasn't a technical possibility, it would be nice if either the Spam Folder Agent or the Outlook Plug-In were supported and up to date.  I put the Brightmail/SCL thing in the ideas forum, perhaps u can help promote the idea?  :)

Thanks for all your help.