Use RBL feature in Exchange or Symantec?

[Brian Dearth]

The server I am working with is running Exchange 2003 SP2 and SMSME
5.0. The company is receiving a significant amount of spam and are
not currently using RBLs or IMF. As a point of reference, there are
only 10 mailboxes on the server but Symantec is showing that it scans
approximately 25,000 messages/day. This seems to be putting a heavy
load on the server and generates very large exchange log files for
such a small server.

My goal is to reduce both the amount of spam that gets through and the
load on the server. To reduce the spam I am planning on first
implementing the zen.spamhaus.org RBL but was unsure if it is better
to do inside SMSME or Exchange itself. What is the recommended
method? Will using RBLs at either level reduce the load on the server
as it shouldn't have to scan the message for viruses and can simply
reject the conneciton based on the IP?

Any help would be greatly appreciated!

[Bharat Suneja [MVP]]

Do the RBL lookups in whatever component that gets the message first.
--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
exchangepedia.com/blog
----------------------------------------------

"Brian Dearth" <brian....@gmail.com> wrote in message
news:1178081683.8...@n59g2000hsh.googlegroups.com...

[Brian Dearth]

On May 2, 1:19 am, "Bharat Suneja [MVP]" <bha...@nospam.org> wrote:
> Do the RBL lookups in whatever component that gets the message first.
> --
> Bharat Suneja
> MVP - Exchangewww.zenprise.com
> NEW blog location:
> exchangepedia.com/blog
> ----------------------------------------------
>

> "Brian Dearth" <brian.dea...@gmail.com> wrote in message

>
> news:1178081683.8...@n59g2000hsh.googlegroups.com...
>
>
>
> > The server I am working with is running Exchange 2003 SP2 and SMSME
> > 5.0. The company is receiving a significant amount of spam and are
> > not currently using RBLs or IMF. As a point of reference, there are
> > only 10 mailboxes on the server but Symantec is showing that it scans
> > approximately 25,000 messages/day. This seems to be putting a heavy
> > load on the server and generates very large exchange log files for
> > such a small server.
>
> > My goal is to reduce both the amount of spam that gets through and the
> > load on the server. To reduce the spam I am planning on first
> > implementing the zen.spamhaus.org RBL but was unsure if it is better
> > to do inside SMSME or Exchange itself. What is the recommended
> > method? Will using RBLs at either level reduce the load on the server
> > as it shouldn't have to scan the message for viruses and can simply
> > reject the conneciton based on the IP?
>

> > Any help would be greatly appreciated!- Hide quoted text -
>
> - Show quoted text -

Thanks for the prompt reponse. I had looked through several exchange
routing diagrams but was not able to determine whether a message is
routed through the antivirus product or connection filtering in
Exchange 2003 first. This is a single server environment. Anyone
happen to know?

[Brian Dearth]

On May 2, 3:33 am, Brian Dearth <brian.dea...@gmail.com> wrote:

Looks like I found the answer. I setup the same RBL in both Exchange
and Symantec then used perfmon to watch the "connections rejected by
block list providers" counter for exchange. When I had the RBLs in
both, the counter showed 0. I took the RBLs out of Symantec and the
counter immediately started increasing indicating that Exchange was
now doing the connection filtering.

So that answer appears to be that SMSME checks the connection/message
prior to Exchange.

>
> Thanks for the prompt reponse. I had looked through several exchange
> routing diagrams but was not able to determine whether a message is
> routed through the antivirus product or connection filtering in
> Exchange 2003 first. This is a single server environment. Anyone

> happen to know?- Hide quoted text -

>
> - Show quoted text -

> On May 2, 1:19 am, "Bharat Suneja [MVP]" <bha...@nospam.org> wrote:
>
>
>
>
>
> > Do theRBLlookups in whatever component that gets the message first.

> > --
> > Bharat Suneja
> > MVP - Exchangewww.zenprise.com
> > NEW blog location:
> > exchangepedia.com/blog
> > ----------------------------------------------
>
> > "Brian Dearth" <brian.dea...@gmail.com> wrote in message
>
> >news:1178081683.8...@n59g2000hsh.googlegroups.com...
>
> > > The server I am working with is running Exchange 2003 SP2 and SMSME
> > > 5.0. The company is receiving a significant amount of spam and are
> > > not currently using RBLs or IMF. As a point of reference, there are

> > > only 10 mailboxes on the server butSymantecis showing that it scans

> > > approximately 25,000 messages/day. This seems to be putting a heavy
> > > load on the server and generates very large exchange log files for
> > > such a small server.
>
> > > My goal is to reduce both the amount of spam that gets through and the
> > > load on the server. To reduce the spam I am planning on first

> > > implementing the zen.spamhaus.orgRBLbut was unsure if it is better