IMF Tune - Bringing Back the Exchange Connection Filter
Check the following frequently asked questions to quickly resolve/answer common questions.
The IMF Tune server is installed on the Exchange server machine. Exchange versions 2007, 2010, 2013, 2016 and 2019 are supported.
Supported Windows platforms include Windows Server 2008 R2 up to Windows Server 2019.
In Exchange 2007/2010 IMF Tune must be installed on the Edge or Hub transport server roles. The Exchange Content Filter or Forefront Protection 2010 for Exchange must also be installed.
In Exchange 2013 and later IMF Tune must be installed on the Edge or Mailbox server roles. The Exchange Content Filter must also be installed.
IMF Tune enables the insertion of SCL ratings into the email subject. This is inserted as a prefix in the format (SCL: x). Thus at the junk email folder one can easily sort all emails by SCL rating. Since false positives are most likely to happen with the lowest SCL rating, sorting enables verification of these emails first. Read Complete Article...
IMF Tune does not change anything in the way emails are moved to the junk email folder. Hence this is purely a matter of configuring the Exchange Content Filter and the email clients. Read Complete Article...
For emails to be deposited to the junk email folder rather than the inbox you need to make sure that this functionality is enabled at the client mailbox. But before doing this make sure that the Content Filter is also correctly configured at the Exchange Server. See more details from: How do I configure emails to be deposited to the junk email folder?
If you already verified the Exchange Server settings, then check that the junk email folder is enabled at the client mailbox. This can be done through Outlook Web Access OWA. Other possible methods for enabling the Junk Email folder are available but depend on your Exchange Version. Read Complete Article...
You need to make sure that the Exchange Content Filter or Forefront Protection 2010 for Exchange Anti-Spam is enabled for IMF Tune to work. Read Complete Article...
Typically you need to do this when spam still manages to reach the recipient Inbox. Read Complete Article...
Optimizing SCL threshold configuration typically aims to
To get the best out of IMF we need to monitor how a set of configuration settings is performing. IMF Tune helps in this task in the following ways:
At IMF Tune create multiple Archive/Logging Profiles. One for each of the SCL ranges requiring independent logging/archiving. In this manner you can setup a unique log file/archive directory for each of the SCL ranges.
In IMF Tune, filtering is a two stage process. First we have the Exchange Content Filter/Forefront stage. Following that we have IMF Tune itself. Emails blocked at the first stage are not processed by IMF Tune.
IMF Tune can perform all the gateway blocking actions itself. Hence the correct setup is that to disable Gateway filtering at the Exchange Content Filter/Forefront and configure any of the Archive/Quarantine, Delete or Reject actions at the IMF Tune configuration.
In Exchange 2007/2010/2013/2016/2019 the Content Filter provides the Quarantine, Reject and Delete gateway blocking options. These may be replaced at IMF Tune by the Reroute, Reject and Delete Email Handling actions.
The Forefront Content Filter provides Quarantine, Reject and Delete gateway blocking. The Forefront Quarantine is a central store, accessible from the Forefront Management Console. These are replaced at IMF Tune using the Web Moderator/Reporting component and the Email Handling Reject and Delete actions. Read Complete Article...
Through the detailed logging information generated by IMF Tune it is possible to identify some common spam sources. For example the originating host IP can be useful in setting up IP blacklists.
This information could also be processed through one of the many reporting tools available on the market. All of these typically support the CSV format generated by IMF Tune. Hence you should be able to import the data directly and then generate reports based on the capabilities of the tool used.
In this case it is best to generate separate log files for the higher range of SCL values where the likeliness of false positives is minimal.
No. Emails rejected through Exchange filtering never reach IMF Tune.
IMF Tune couples tightly with the Exchange Content Filter. Hence which emails are processed or left unprocessed is determined by Exchange and not IMF Tune.
By default the Content Filter won't process emails from an authenticated connection. Thus these are handled as unprocessed by IMF Tune.
Another scenario giving rise to unprocessed emails is when the Content Filter is not enabled.
999 is the SCL value assigned by IMF Tune to blacklisted emails. At the moment the Exchange Content Filter does not define an SCL for blacklisting. Thus we had to invent one. We chose a value that is much larger than the largest defined SCL. For this reason, whenever choosing to expose the SCL value, 999 will be set in case of blacklisted emails.
With Whitelisting, Blacklisting and SCL Rules it is possible for a single email to give rise to multiple matches. IMF Tune follows a "play safe" rule, and the lowest SCL rating is applied. For example if an email contains both a blacklisted keyword and a whitelisted keyword, the email is whitelisted.
Extending this concept further, if an email matches an SCL Rule configured to set the SCL to 5 and also matches a blacklisted keyword, than the final SCL will be 5.
SCL Rules applying 'increment by 'and 'decrement by' operations are considered to have the lowest priority. The increments and decrements are only computed if no other match is found that would set the email to a fixed SCL value. If computed, increments and decrements add up so that the final SCL value is the net result.
So to recap, the final SCL rating is assigned based on these priority rules:
In Exchange 2007/2010/2013/2016/2019, we configure the perimeter IP address list from the shell with
The IMF Tune web interface requires a Microsoft SQL backend database. All MS SQL versions from 2008, 2012, 2014, 2016 and 2017 are supported, including the free MS SQL Express editions.
For the system to work IMF Tune requires an SQL Server that supports both Windows Authentication and SQL Authentication. This is sometimes referred to as mixed mode authentication. In case SQL Authentication is not enabled, IMF Tune will be unable to upload any emails to the database server. Complete Article...
The IMF Tune Moderator/Reporting Web Component displays date and time information in various parts of the interface. Different countries have differing methods for formatting such information. For example in US the short date format used is M/d/yyyy. In the UK the format dd/MM/yyyy is used instead.
The Web Component fixes the format to be used for displaying time information at installation time. This format may not be the one in use in your region. In that case, follow the procedure presented here to change it. Complete Article...
Email to: email@example.com
IMF Tune on first install runs in free 30day evaluation mode. Once evaluation is over it stops processing emails. At this point a license key must be supplied in order to restore full product functionality.
You may obtain an extended evaluation period by contacting:
When licensing IMF Tune the following information is required:
IMF Tune provides a number of license options based on the number of mailboxes being serviced. Currently license levels for 15, 30, 50, 100, 200, 500 and unlimited mailboxes are available. You need to choose a license that matches or exceeds the number of mailboxes serviced by your organization.
Once the license type is identified, order one license for each machine where IMF Tune is to be installed. For example an organization servicing 150 mailboxes running IMF Tune on two servers would require 2 licenses for 200 mailboxes.
Note that in general IMF Tune is only installed on the internet facing servers and not backend mailbox servers. However this depends on your network configuration.
For help on choosing the correct license contact: firstname.lastname@example.org
No. The feature set is identical.
A license is only needed for the servers where IMF Tune is installed. Typically anti-spam protection is installed on the internet facing bridgeheads. Thus these would be the only servers requiring IMF Tune.
The secure ordering system uses SSL to encrypt your details so as to safeguard sensitive data such as the credit card number.
Yes. IMF Tune licenses are valid for a period of 1 year. Once the license validity period is exceeded the subscription must be renewed for a new license to be provided. If the subscription is not renewed IMF Tune will stop processing emails and allow all emails through unfiltered.
Contact email@example.com they will be able to supply you with an evaluation license.
No. The IMF Tune evaluation product is effectively the full product. All you need is to supply it with a license key and no reinstallation is required. For details on how to license the product refer to the User Manual.
Yes. IMF Tune Subscriptions include technical support and product updates. There is no additional charge for support. All you need is to have a valid Subscription. Contact technical support on firstname.lastname@example.org with problems you may have when running IMF Tune.
IMF Tune Subscriptions should be renewed before the expiry of the last Subscription in order to avoid spam filtering from stopping. In case a Subscriptions expires you may order a new Subscription and start anew.
Email to: email@example.com