question on IP Block List in Exchange 2007

Kremlar · Joined: 05 Aug 2007 Posts: 14

I always assumed that IPs listed in here were manually added by the admin,
however I now see that IPs are somehow added here automatically.

Could some please explain this for me, or point me somewhere that explains
this?

Are IPs listed here provided by IP Block List Providers that are setup on
the server? I always thought they were 2 separate functions....

Thanks in advance!

Archived from group: microsoft>public>exchange>misc

Bharat Suneja [MVP] · Joined: 05 Aug 2007 Posts: 1043

- IP Block List Providers are RBLs - you set them up manually. Once setup,
source addresses for incoming smtp connections are looked up in those
providers' DNS zones.
- IP Block Lists can either have manually entered IP addresses, or those
added there for a configurable period of 24 hours by the Sender Reputation
Filter - which looks at sending hosts' SMTP "behaviour", does things like
reverse dns lookups, open proxy checks, protocol checks like names used in
fqdn, reputation of a sending host in terms of amount of spam sent v/s
regular email sent, amongst other things.
Sender Reputation
http://technet.microsoft.com/en-us/library/bb124512(EXCHG.80).aspx
- To get a list of IP addresses added by the Sender Filter:
Get-IPBlockListEntry | where {$_.isMachineGenerated}
Those entered manually:
Get-IPBlockListEntry | where {$_.isMachineGenerated -eq $false}

- To configure Sender Reputation Filter to not move suspect IPs to the IP
Block List:
Set-SenderReputationConfig -SenderBlockingEnabled $false

You can also set the SRL threshold (just like you set the SCL for the
Content Filter):
Set-SenderReputationConfig -SrlBlockThreshold 7

(Where 7 can be a value from 1-9).

--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
exchangepedia.com/blog
----------------------------

"Kremlar" wrote in message @TK2MSFTNGP04.phx.gbl...
>I always assumed that IPs listed in here were manually added by the admin,
>however I now see that IPs are somehow added here automatically.
>
> Could some please explain this for me, or point me somewhere that explains
> this?
>
> Are IPs listed here provided by IP Block List Providers that are setup on
> the server? I always thought they were 2 separate functions....
>
> Thanks in advance!

Kremlar · Joined: 05 Aug 2007 Posts: 14

Thanks for the great reply!

Does the IP Allow List take priority over the IB Block List?

"Bharat Suneja [MVP]" wrote in message @TK2MSFTNGP02.phx.gbl...
>- IP Block List Providers are RBLs - you set them up manually. Once setup,
>source addresses for incoming smtp connections are looked up in those
>providers' DNS zones.
> - IP Block Lists can either have manually entered IP addresses, or those
> added there for a configurable period of 24 hours by the Sender Reputation
> Filter - which looks at sending hosts' SMTP "behaviour", does things like
> reverse dns lookups, open proxy checks, protocol checks like names used in
> fqdn, reputation of a sending host in terms of amount of spam sent v/s
> regular email sent, amongst other things.
> Sender Reputation
> http://technet.microsoft.com/en-us/library/bb124512(EXCHG.80).aspx
> - To get a list of IP addresses added by the Sender Filter:
> Get-IPBlockListEntry | where {$_.isMachineGenerated}
> Those entered manually:
> Get-IPBlockListEntry | where {$_.isMachineGenerated -eq $false}
>
> - To configure Sender Reputation Filter to not move suspect IPs to the IP
> Block List:
> Set-SenderReputationConfig -SenderBlockingEnabled $false
>
> You can also set the SRL threshold (just like you set the SCL for the
> Content Filter):
> Set-SenderReputationConfig -SrlBlockThreshold 7
>
> (Where 7 can be a value from 1-9).
>
> --
> Bharat Suneja
> MVP - Exchange
> www.zenprise.com
> NEW blog location:
> exchangepedia.com/blog
> ----------------------------
>
>
> "Kremlar" wrote in message
> @TK2MSFTNGP04.phx.gbl...
>>I always assumed that IPs listed in here were manually added by the admin,
>>however I now see that IPs are somehow added here automatically.
>>
>> Could some please explain this for me, or point me somewhere that
>> explains this?
>>
>> Are IPs listed here provided by IP Block List Providers that are setup on
>> the server? I always thought they were 2 separate functions....
>>
>> Thanks in advance!
>

Bharat Suneja [MVP] · Joined: 05 Aug 2007 Posts: 1043

> Does the IP Allow List take priority over the IB Block List?
Absolutely... !

Understanding Anti-Spam and Antivirus Mail Flow
http://technet.microsoft.com/en-us/library/aa997242(EXCHG.80).aspx

The above link has plenty of info and a nice little flow-chart depicting how
mail flows and which agents fire in what order.

--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
exchangepedia.com/blog
----------------------------

"Kremlar" wrote in message
news:%23y4nLEdbIHA.5768@TK2MSFTNGP03.phx.gbl...
> Thanks for the great reply!
>
> Does the IP Allow List take priority over the IB Block List?
>
>
> "Bharat Suneja [MVP]" wrote in message
> @TK2MSFTNGP02.phx.gbl...
>>- IP Block List Providers are RBLs - you set them up manually. Once setup,
>>source addresses for incoming smtp connections are looked up in those
>>providers' DNS zones.
>> - IP Block Lists can either have manually entered IP addresses, or those
>> added there for a configurable period of 24 hours by the Sender
>> Reputation Filter - which looks at sending hosts' SMTP "behaviour", does
>> things like reverse dns lookups, open proxy checks, protocol checks like
>> names used in fqdn, reputation of a sending host in terms of amount of
>> spam sent v/s regular email sent, amongst other things.
>> Sender Reputation
>> http://technet.microsoft.com/en-us/library/bb124512(EXCHG.80).aspx
>> - To get a list of IP addresses added by the Sender Filter:
>> Get-IPBlockListEntry | where {$_.isMachineGenerated}
>> Those entered manually:
>> Get-IPBlockListEntry | where {$_.isMachineGenerated -eq $false}
>>
>> - To configure Sender Reputation Filter to not move suspect IPs to the IP
>> Block List:
>> Set-SenderReputationConfig -SenderBlockingEnabled $false
>>
>> You can also set the SRL threshold (just like you set the SCL for the
>> Content Filter):
>> Set-SenderReputationConfig -SrlBlockThreshold 7
>>
>> (Where 7 can be a value from 1-9).
>>
>> --
>> Bharat Suneja
>> MVP - Exchange
>> www.zenprise.com
>> NEW blog location:
>> exchangepedia.com/blog
>> ----------------------------
>>
>>
>> "Kremlar" wrote in message
>> @TK2MSFTNGP04.phx.gbl...
>>>I always assumed that IPs listed in here were manually added by the
>>>admin, however I now see that IPs are somehow added here automatically.
>>>
>>> Could some please explain this for me, or point me somewhere that
>>> explains this?
>>>
>>> Are IPs listed here provided by IP Block List Providers that are setup
>>> on the server? I always thought they were 2 separate functions....
>>>
>>> Thanks in advance!
>>
>

Darren · Joined: 05 Aug 2007 Posts: 38

Hi Bharat,
Excellent info.!!. BTW : not sure if its just my computer but when I click
on the link you provided my browser just closes.. any idea..?.

TIA
"Bharat Suneja [MVP]" wrote in message
news:%23k7pBYdbIHA.4180@TK2MSFTNGP06.phx.gbl...
>> Does the IP Allow List take priority over the IB Block List?
> Absolutely... !
>
> Understanding Anti-Spam and Antivirus Mail Flow
> http://technet.microsoft.com/en-us/library/aa997242(EXCHG.80).aspx
>
> The above link has plenty of info and a nice little flow-chart depicting
> how mail flows and which agents fire in what order.
>
> --
> Bharat Suneja
> MVP - Exchange
> www.zenprise.com
> NEW blog location:
> exchangepedia.com/blog
> ----------------------------
>
>
> "Kremlar" wrote in message
> news:%23y4nLEdbIHA.5768@TK2MSFTNGP03.phx.gbl...
>> Thanks for the great reply!
>>
>> Does the IP Allow List take priority over the IB Block List?
>>
>>
>> "Bharat Suneja [MVP]" wrote in message
>> @TK2MSFTNGP02.phx.gbl...
>>>- IP Block List Providers are RBLs - you set them up manually. Once
>>>setup, source addresses for incoming smtp connections are looked up in
>>>those providers' DNS zones.
>>> - IP Block Lists can either have manually entered IP addresses, or those
>>> added there for a configurable period of 24 hours by the Sender
>>> Reputation Filter - which looks at sending hosts' SMTP "behaviour", does
>>> things like reverse dns lookups, open proxy checks, protocol checks like
>>> names used in fqdn, reputation of a sending host in terms of amount of
>>> spam sent v/s regular email sent, amongst other things.
>>> Sender Reputation
>>> http://technet.microsoft.com/en-us/library/bb124512(EXCHG.80).aspx
>>> - To get a list of IP addresses added by the Sender Filter:
>>> Get-IPBlockListEntry | where {$_.isMachineGenerated}
>>> Those entered manually:
>>> Get-IPBlockListEntry | where {$_.isMachineGenerated -eq $false}
>>>
>>> - To configure Sender Reputation Filter to not move suspect IPs to the
>>> IP Block List:
>>> Set-SenderReputationConfig -SenderBlockingEnabled $false
>>>
>>> You can also set the SRL threshold (just like you set the SCL for the
>>> Content Filter):
>>> Set-SenderReputationConfig -SrlBlockThreshold 7
>>>
>>> (Where 7 can be a value from 1-9).
>>>
>>> --
>>> Bharat Suneja
>>> MVP - Exchange
>>> www.zenprise.com
>>> NEW blog location:
>>> exchangepedia.com/blog
>>> ----------------------------
>>>
>>>
>>> "Kremlar" wrote in message
>>> @TK2MSFTNGP04.phx.gbl...
>>>>I always assumed that IPs listed in here were manually added by the
>>>>admin, however I now see that IPs are somehow added here automatically.
>>>>
>>>> Could some please explain this for me, or point me somewhere that
>>>> explains this?
>>>>
>>>> Are IPs listed here provided by IP Block List Providers that are setup
>>>> on the server? I always thought they were 2 separate functions....
>>>>
>>>> Thanks in advance!
>>>
>>
>

Exchange Distribution List Limitation - Exchange 2007 There's a known problem with Distribution Lists in MS Exchange 2003 server, whereby when a DL exceeds a certain size the client trying to use the DL recieves an error (see "Can't open this item. There is not enough

Exchange 2007 rollup install question I recently installed Exchange 2007 SP1 server. I did not install any of the rollups. Do I install just rollup 5 or do I have to start with 1 and work my way up? Jeff

Create a distribution list from a list of external addresses I have a sql table that has an attribute that contains email addresses of about 500 external addresses. I need to create an distribution list in order to send emails to every email address contained in the sql table. I am running Exchange 2003. The list o

Block out going message if sender ID is not vald AD user hello, my problem is that, to prevent infected virus and send out to internet. is there any setup insides exchange 2003 enterprise ed. validate the sender id. if not valid AD user. drop the out going mail thanks regards, Billy

Exchange as a list server One of our attorneys wants to utilize an internal list server for distributing information. A Google search points me to some Ex5.5 guidelines and another indicates if you really want a full functioning list server that you need to purchase some add-ons.