Exchange Intelligent Message Filter's custom weighting feature

Exchange Server 2003 Service Pack 2 (SP2) and Exchange Intelligent Message Filter (IMF) offer a custom weighting feature that can designate incoming message as legitimate if specific words or phrases appear in the email body or subject line.

Almost every third-party spam-filtering product offers some kind of custom whitelisting feature that designates

a message as legitimate if specific words or phrases appear in the email body or subject line.

For instance, when I email an editor I write for, I often use the header "EDIT:" (short for "Editorial") in the subject line. That particular header acts a whitelist trigger that ensures that my messages will be automatically accepted by the receiving mail server.

What you may not realize is that Exchange Server 2003 Pack 2 (SP2) and the Exchange Intelligent Message Filter (IMF) provide the same functionality through their custom weighting feature.

There is a catch though. There is no user interface for it, so you have to write a configuration file (standard XML) by hand and drop it into the same directory as the MSExchange.UceContentFilter.dll file.

Here's an example of the file to be used (as it is outlined in Microsoft's documentation for Exchange 2003 SP2; do an Edit -> Find for the "Custom Weighting Feature" section):

<?xml version="1.0" encoding="UTF-16"?>
<CustomWeightEntries xmlns=http://schemas.microsoft.com/2005/
CustomWeight>
     <CustomWeightEntry Type="BODY" Change="1" Text="foo1"/>
     <CustomWeightEntry Type="BODY" Change="-1" Text="foo2"/>
     <CustomWeightEntry Type="BODY" Change="5" Text=
"Special offer"/>
     <CustomWeightEntry Type="BODY" Change="-9" Text=
"Verlängertes Angebot"/>
     <CustomWeightEntry Type="SUBJECT" Change="MIN" 
Text="特別提供"/>
     <CustomWeightEntry Type="BOTH" Change="MAX" Text=
"Offre spéciale"/>
</CustomWeightEntries>

Each of the CustomWeightEntry entries has the following values:

  • Text: A Unicode string that describes the text to apply a custom weight to.

  • Type: Describes whether the matching text is found in the BODY of the message, the SUBJECT, or BOTH.

  • Change: How much to change the Spam Confidence Level (SCL) score of a message that matches the text. This is an integer from -9 to 9. It's not the SCL itself, but how much the SCL of the message will change.

    You can also use MIN and MAX as shorthand ways to set the SCL to the minimum and maximum allowed values, respectively. (If a given message matches more than one keyword -- one with a MIN value and another with a MAX value -- the SCL is set to zero.)

Note that the XML file must be saved as a UTF-16 file. Also, if it's broken or malformed, Exchange IMF will not load. So you may want to either use the above example as a template or use an XML authoring tool to make sure it's correctly formatted.

About the author: Serdar Yegulalp is editor of Windows Insight, a newsletter devoted to hints, tips, tricks, news and goodies for all flavors of Windows users.

Do you have comments on this tip? Let us know.

Related information from SearchExchange.com:

  • Tip: Microsoft hotfix offers selective Exchange IMF filtering
  • Tip: Freeware 'greylisting' for Exchange Server
  • Tip: Managing the Exchange IMF archive directory
  • Crash Course: Exchange Intelligent Message Filter
  • Learning Guide: How to fight spam on Exchange Server
  • Reference Center: Spam prevention and management resources

    Please let others know how useful this tip was via the rating scale below. Do you have a useful Exchange Server or Microsoft Outlook tip, timesaver or workaround to share? Submit it to SearchExchange.com. If we publish it, we'll send you a thank-you gift only an IT geek could love.

  • This was first published in March 2007

    Dig deeper on Spam and virus protection

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    0 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    SearchWindowsServer

    SearchEnterpriseDesktop

    SearchCloudComputing

    SearchSQLServer

    Close