Friday, January 11, 2008

ASSP - forwarding spam adds to whitelist

I have a specific issue where CompanyA.com split off with SubCompanyA.com and in the process, SubCompanyA.com's users still wanted to forever be reached by their old @CompanyA.com email address. Inside Exchange, I added quite a few Contact efwd emails which worked quite nicely. I have another post ... somewhere about using the exchange-to-csv export and import to help automate this process.

In any case, I noticed a LOT of spam that was resulting from whitelisted email addresses from spammers. It appears that my spam filter, ASSP, figured that all email coming from my Exchange Server is whitelisted mail, no matter how I tried to redlist the domains or users or anything. Why did my Exchange Server whitelist spam?

It turns out that the Exchange Server Contacts forwarded out through my spam filter to SubCompanyA.com. The question comes: how to avoid using my spam filter for SubCompanyA.com bounces? (of course, the other question is why the spam filter isn't kicking these out in the first place, but that's likely because of the whitelist=valid email issue. OK, it's circular reasoning, but let's stop the whitelisting)

This site Configuring and Using an SMTP Connector shows how to add an SMTP connector for problem domains. Ah! a solution! I set one up for the new SMTP server (actually the new SMTP server's spam front end) and now @CompanyA.com's forwardings to SubCompanyA.com's email addresses never touch (read: don't add to the whitelist of) my spam filter. This may cost my Bayesian filter to stop understanding valid emails between CompanyA.com and SubCompanyA.com, but then again, whitelisting between the two companies should already have occurred and the further CompanyA.com/SubCompanyA.com whitelisting is trivial.

Edited to add: Well, maybe not trivial, per se. After realizing what will happen (whitelist expiration of emails@SubCompanyA.com after 90 days), SubCompanyA.com's inbound emails will possibly need to be vetted each inbound time. Well... at least I can noprocess SubCompanyA.com inbound from the spam filter, so that seems to fix that.

No comments:

Blog Archive