Exchange Server TechCenter >
Exchange Server Forums
>
Anti-virus/Anti-spam
>
Exchange, SCL ratings and Spam
Exchange, SCL ratings and Spam
- We have been running an Exchange Edge Server for the last couple of years with the following SCL configuration under Content Filtering;
Delete = 9
Reject = 8
Quarantine = 7
In the last few months we have been seeing an increase of SPAM entering to the user's mailbox and after analysing the messages, on average have a PCL of 2 and an SCL of 4/5.
I am interested to know what the current best practice is out in the field with regards to SCL values under content filtering.
Thanks
Answers
- you can configure it as you want, accordingly with your organization's needs.
Those thresholds are to be modified if something is going wrong. Eg False positives or SPAM increase.
Have you tried add a "blocked IPs provider" and adding zen.spamhaus.org ?
This really has lowered spam for me.
HTH
Diego Castelli- Marked As Answer byMike Shen Friday, July 17, 2009 9:24 AM
Having the lowest SCL at 7 seems reasonable.
What is your Information store SCL level?
'Get-OrganizationConfig | fl SCLJunkThreshold'
5 or 4 is usually normal values.
But as others have said. you have to adjust SCL levels to your organisation needs.
lasse at humandata dot se, http://anewmessagehasarrived.blogspot.com- Marked As Answer byMike Shen Friday, July 17, 2009 9:24 AM
All Replies
- you can configure it as you want, accordingly with your organization's needs.
Those thresholds are to be modified if something is going wrong. Eg False positives or SPAM increase.
Have you tried add a "blocked IPs provider" and adding zen.spamhaus.org ?
This really has lowered spam for me.
HTH
Diego Castelli- Marked As Answer byMike Shen Friday, July 17, 2009 9:24 AM
- Hi Diego,Thanks for your reply.I've got SPAMhaus and SPAMcop setup as IP Block List providers already which filter out quite a fair bit.I understand the thresholds but am interested to know what other's have set their SCL to as I have a feeling that mine might be too relaxed considering how SPAM has evolved in the last couple of years.Cheers
Having the lowest SCL at 7 seems reasonable.
What is your Information store SCL level?
'Get-OrganizationConfig | fl SCLJunkThreshold'
5 or 4 is usually normal values.
But as others have said. you have to adjust SCL levels to your organisation needs.
lasse at humandata dot se, http://anewmessagehasarrived.blogspot.com- Marked As Answer byMike Shen Friday, July 17, 2009 9:24 AM
- Hi Lasse,Thanks for your response and the clarification on SCL values. SCLJunkThreshold is set to 4 as expected.I have done some tweaking in particular to making the SCL value applied to our Transport Rules living on our Edge Server via http://technet.microsoft.com/en-us/library/bb691082.aspx. MSFT should make it the default priority :)Seems to have done the trick as Content Filtering is now being applied prior to the Transport Rules.Cheers
