The Exchange Intelligent Message Filter

Spam, or unsolicited commercial email (UCE), is an increasing annoyance for email administrators and users alike. Microsoft Exchange Server 2003 features increased antispam protection, offering a full array of filters that you can deploy to combat the bad guys. (For more details about Exchange 2003's antispam improvements, see the sidebar "Better Protection in Exchange 2003," http://www.winnetmag.com, InstantDoc ID 42683.) But filters rely on external input, such as realtime blackhole lists (RBLs), and you need a reasonable degree of expertise to configure Exchange 2003's filters correctly. Even then, keeping pace with spam is almost impossible because spammers frequently change their tactics to evade detection. For example, spammers switch domains to avoid RBLs and constantly play with the text of their messages or use foreign languages to avoid recognition by antispam tools.

To help you better protect your Exchange systems, Microsoft Research has developed SmartScreen Technology, a patented machine-based learning technology that can recognize the distinguishing characteristics of both legitimate email and spam, based on a huge collection of messages that Microsoft gathered from inside the company and from customers. Early versions of SmartScreen Technology appear in MSN 8, Microsoft Hotmail, and Microsoft Office Outlook 2003, but the technology's first major appearance is in the Microsoft Exchange Intelligent Message Filter (IMF), an Exchange 2003 add-on that Microsoft released in May 2004. IMF's implementation is designed to detect spam that tries to enter an organization through its Exchange SMTP connectors. Microsoft supports IMF only on standalone servers running Exchange 2003 Enterprise Edition or Exchange 2003 Standard Edition; you can't install IMF on a clustered Exchange 2003 server or on earlier Exchange versions. (You can deploy IMF on Exchange 2003 gateway servers to protect Exchange 2000 Server or Exchange Server 5.5 mailbox servers, but this type of implementation delivers only half the potential benefit of IMF.) Microsoft originally planned to make IMF available only to customers who had licensed Exchange 2003 under Software Assurance (SA), but later reconsidered that decision and, at Microsoft TechEd 2004, released IMF to all Exchange 2003 customers. Is IMF a worthwhile addition to your Exchange 2003 deployment—or perhaps even worth an upgrade to Exchange 2003? You'll be better equipped to make that decision if you know a bit about how IMF works and how you might benefit from deploying it. . . .