RE: ISA FP1 does NOT fix the SMTP Filter
- From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Tue, 14 Jan 2003 18:26:24 -0600
Hi Edward,
Before you shut the door on the SMTP filter, keep in mind that some
spammers use tricks that fool all the keyword, domain based filters. The
replay to address might not be the soruce address, and graphics replace
text. I think they also might be fragmenting the SMTP messages, which is
something I don't know much about, but have seen references to the
phenomenum, and that might be a problem.
Thanks!
Tom
www.isaserver.org/shinder
-----Original Message-----
From: Edward Sullivan [mailto:esullivan@xxxxxxx]
Sent: Tuesday, January 14, 2003 5:20 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: ISA FP1 does NOT fix the SMTP Filter
http://www.ISAserver.org
Well, I suppose I could go on "squeaking" indefinitely like I have for
the last month in hope of getting the "grease", but in the meantime spam
still manages to slip past the SMTP filter...
:(
Based on my experience and the fact that neither you nor I can get
information on the max size for the registry keys or why the SMTP filter
is sporadically missing both domains and keywords, I suppose I will have
to nuke my ISA screener server and rebuild it with MailEssentials
instead. If I can work MailEssentials into my budget, that is...
THANK YOU for all your help on this issue, Tom, you are a fantastic guy
and a fantastic resource to the ISA community!
(I am not leaving the list, so if anyone does get any additional info on
this issue, please let me know.)
// END OF SQUEAK -->
Ed Sullivan
Director of Information Services
esullivan@xxxxxxx < mailto:esullivan@xxxxxxx>
KMA Direct Communications
Confidential and Proprietary
-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx]
Sent: Tuesday, January 14, 2003 3:01 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: ISA FP1 does NOT fix the SMTP Filter
http://www.ISAserver.org
Hi Edward,
You don't need any inside contacts. The Microsoft folks read this list,
so you've got an almost direct link :-) I am using MailEssentials and I
think its pretty nice. I think the ISA Server SMTP filter is OK, but
suffers from "documentation cachexia" :-) It would be nice to know what
the size limit is for these keys.
If you do go to GFI, I have a HUMONGUOUS keyword list that you can use.
I don't focus on domain names, since they are routinely faked and that
often hurts legitimate enterprises. Look at the debacle of RBLs!
Everytime I see something on RBLs it reminds me of those black and white
films for Joe McCarthy saying "Are you, or have you ever been, a member
of the spammer party" :-)
HTH,
Tom
Thomas W Shinder
www.isaserver.org/shinder
http://tinyurl.com/1jq1
http://tinyurl.com/1llp
-----Original Message-----
From: Edward Sullivan [mailto:esullivan@xxxxxxx]
Sent: Tuesday, January 14, 2003 12:33 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] ISA FP1 does NOT fix the SMTP Filter
http://www.ISAserver.org
I was hoping that FP1 would fix the failing keyword and domain issues
with the SMTP filter, but it appears that it does not. For example, I
have a filter keyword of "YourFreeLunch.com" and a domain keyword for
"YourFreeLunch.com", and yet email from this domain made it past the
filter into my organization:
>-----Original Message-----
>From: Mary [mailto:reply@xxxxxxxxxxxxxxxxx]
>Sent: Tuesday, January 14, 2003 10:21 AM
>To:
>Subject: Why didn't you call me?
At this point, I am considering dumping ISA for another product, such as
GFI Mail Essentials. I know that ISA is intended primarily as a firewall
product and not an email security product, but the reason we stopped
using it as a firewall was because of bugs in the pre-SP1 version!
Out of principle I have decided not to give MSFT $250 for a support call
again, the last time I did it took them a month to correct the problem
in ISA which turned out to be a bug in their software.
Anyone out there have ANY leads, information, help, suggestions,
anything? Tom, any inside contacts at MSFT you could forward this to? I
am at the end of my rope with this one.
Thanks!
Ed Sullivan
Director of Information Services
esullivan@xxxxxxx < mailto:esullivan@xxxxxxx>
KMA Direct Communications
Confidential and Proprietary
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
esullivan@xxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
