Small Business Server 2008 Support and NDR Spam Filtering in IMF Tune v4.2

IMF Tune v4.2 is now available for download!

This release includes important updates for SBS 2008 installations. We also have significant improvements in NDR Spam filtering and the installer.

Small Business Server 2008 Support

We identified a problem in IMF Tune v4.1 (build 4.1.008.06) and earlier when installed on the SBS2008 Exchange 2007 server. The problem was caused because of the User Access Control functionality that is enabled by default. The problem could cause changes at the configuration not to be enforced by the filtering engine.

With this update we can confirm full support for the SBS2008 platform.

Filtering Backscatter SPAM

The increase in Non-Delivery Report (NDR) Spam and other types of backscatter prompted us to harden our filtering engine in this area.

NDRs are just one type of Delivery Status Notification (DSN) emails. Apart for delivery failures, other DSN types can be used to report successful delivery, delayed delivery, relaying and address list expansion.

In addition to DSNs, backscatter may also be caused by Disposition Notifications (DN). DN reports include Read Receipts and Deletion Notifications.

DSN and DN report emails are responsible for the vast majority of backscatter SPAM. IMF Tune is now able to apply additional processing to these reports ensuring all available information is employed to identify spam.

Note: IMF Tune through its coupling with Exchange 2003 Intelligent Message Filter/Exchange 2007 Content Filter was already able to analyze these emails determining an initial SCL rating. However on applying white/black lists and SCL Rules, some of the email report content was not processed.

Report emails may include (as an attachment) the original email for which the report was generated. In backscatter spam, this would be the originally submitted spam email. Thus it would normally contain content very likely to match your blacklists. Likewise in case of legitimate report emails, the attachment content is likely to match your whitelists. Thus IMF Tune is now also processing the content of this attachment.

Furthermore Report emails include an additional MIME part hosting various headers. These include more information that could be employed for filtering purposes. IMF Tune is now also extracting these headers, allowing the enforcement of rules against them. The following is the list of DSN/DN standard headers that IMF Tune is gaining access to, in alphabetical order. Of course it is also possible to have custom headers. These would also be processed together with the standard headers listed below.

Standard headers used in DSN/DN reporting:
Action
Arrival-Date
Diagnostic-Code
Disposition
DSN-Gateway
Error
Failure
Final-Log-Id
Final-Recipient
Last-Attempt-Date
MDN-Gateway
Original-Envelope-Id
Original-Message-id
Original-Recipient
Received-From-MTA
Remote-MTA
Reporting-MTA
Reporting-UA
Status
Warning
Will-Retry-Until

IMF Tune v4.2 Upgrade Support

IMF Tune now supports direct upgrading from earlier v4.x builds.

In the past upgrading IMF Tune required an uninstall-install cycle. The recommended upgrade procedure for users running earlier v4.x builds now changes. Upgrading simply involves running the v4.2 installer on top of the current installation. In this manner, IMF Tune will automatically make sure to retain the original installation path and the current configuration settings.

The upgrade procedure for IMF Tune version 2 or version 3 does not change. In this case it is still required to perform the uninstall-install cycle. For more details please refer to HOWTO: Upgrade to IMF Tune v4.

Licensing

IMF Tune v4.2 is a free update for all IMF Tune v4 users. IMF Tune v4 installations can be upgraded and the license transferred to IMF Tune v4.2.

Upgrades

Upgrading to IMF Tune v4.2 may involve an in-place upgrade or a move to new server hardware. This is especially true since IMF Tune v4.2 supports both Exchange 2003 and 2007. Exchange 2007 requires a migration to a 64-bit platform in this case IMF Tune would also need to move along.

For complete details on all possible upgrade scenarios check HOWTO: Upgrade to IMF Tune v4.

Version Information

This information applies to IMF Tune v4.2 build number 4.2.011.18. If IMF Tune is already installed you can verify the current build number from the configuration. In earlier IMF Tune versions the build number was available under the WinDeveloper category. In later releases the build is available under the Miscellaneous category.