Anti-Spam Infrastructure

Mail submitted from the Internet enters the Microsoft® Exchange organization at the SMTP gateway; it is on this gateway server that a spam filter would process incoming mail. It is assumed that mail generated from within the organization is not spam.

As each anonymously submitted message is accepted at the gateway from the Internet, the message is passed to the content filter through the transport event infrastructure where the filter associates a spam confidence level (SCL) rating with the message. The SCL is a weighting given to an individual message that indicates the message's potential spam content. A higher SCL value represents an increased likelihood that the message is spam. For more information about the SCL, see Spam Confidence Level.

After being evaluated by the spam filter, the message is either blocked from entering the organization, or the SCL value is added to the message which is then transmitted to the mailbox server. Because the SCL property is persisted on the message, there is no need to evaluate the message on each hop. After the mailbox server receives the message, the Store SCL Processor, a new functionality provided in the Exchange Server 2003 store, determines, in conjunction with Microsoft Outlook® and Outlook Web Access Junk E-mail Lists, whether the message will be placed in the user's Inbox or Junk E-mail folder.

The following diagram illustrates how a message flows through the Exchange Server 2003 anti-spam infrastructure, and how the protocol sink template and the spam filter fit within this infrastructure.

Based on certain connection criteria, it may not be necessary to route a message through the content filter. Extended Message Properties outlines the properties that the content filter should use to make this determination.