Spammers use all type of techniques to get their rubbish through to you and one technique that they use is called spoofing, whereby they forge the sender address and use your own email address, or firstname.lastname@example.org as the sender address.
There are various ways to combat this and in Exchange 2003, you can do the following:
- Setup Sender Filtering to stop inbound emails that are supposedly from your own domain name.
- Setup Tarpitting to slow down spammers who try to determine the email addresses that are sitting on your Exchange server.
- Setup a Sender Policy Framework (SPF) record for your domain.
- Setup Sender ID filtering to check SPF records for inbound email and reject ones that fail.
- Setup Recipient Filtering (won’t solve the spoofing problem, but it is highly recommended to set this up too)
To set these various Anti-Spam techniques up, you should first check that you are using Exchange 2003 Service Pack 2 by opening up Exchange System Manager, expanding Servers, then click onto your server and then right-click on your server and choose properties.
The screen that follows should advise you what Service Pack your Exchange Server is on. If it does not say Service Pack 2, please visit the following link to download and install it:
If you are already on Exchange 2003 Service Pack 2, then please review the following articles to setup the various Anti-Spam techniques:
- Sender / Recipient Filtering – http://www.msexchange.org/tutorials/Sender-Recipient-Filtering.html
- Tarpitting – http://support.microsoft.com/kb/842851
- Sender Policy Framework – Visit http://old.openspf.org/wizard.html to create an SPF record for your domain then add the SPF record to your domains DNS records as a Text record with the Wizard results as the detail of the record. An example SPF record looks similar to the following ; v=spf1 a mx ip4:126.96.36.199 mx:mail.yourdomain.com -all
- Sender ID Filtering – http://www.msexchange.org/tutorials/Configuring-enabling-Sender-ID-filtering-Exchange-2003-SP2.html
Once you have setup the above, you should be free from spoofed emails claiming to come from email@example.com or from your own email address to yourself!
As an alternative to the above, you could simply install some Anti-Spam software and one product that I have been using recently after being recommended it by a Microsoft Exchange MVP is Vamsoft ORF which is currently priced at $239 per server and has drastically reduced the amount of spam that I have been receiving and now my customers who also have Vamsoft, have also seen a dramatic reduction in their spam levels too. Their website is www.vamsoft.com.