Symantec Premium Antispam Optimisation

Settings for Symantec Premium Antispam are fairly customisable, and should be tweaked according to client wishes. That said, there is a default level you should start tweaking from, and that is not how Symantec is configured out of the box.

Any changes should be discussed with clients beforehand, so staff can be on the lookout for false positives.

Key Concepts

There are some key concepts:

• SCL values - Exchange scans messages received and those that are determined to be spam are assigned a SCL value of 1 (extremely low likelihood that the message is spam) to 9 (extremely high likelihood that the message is spam).
• Store Action Threshold - The Store Action Threshold (SAT) in Microsoft Exchange 2003 works with the SCL value that is stamped on an email message to determine the destination of the message. When the SAT value is not set, Exchange sends all messages with a SCL value to the user's Junk E-mail folder. If the SAT value is set and a message has a SCL value that is higher than the SAT threshold, Exchange sends the message to the user's Junk E-mail folder. If the SCL value is lower than or equal to the SAT value, the message goes into the user's Inbox.
• Symantec Spam Rating - Symantec calculates a spam score from 1 to 100 for each message. If a message scores from 90 to 100, it is defined as spam. You can define a suspected spam threshold between 25 and 89 (default is 72) in the Spam Scoring section of Premium AntiSpam Settings.

You are best off setting the Store Action Threshold to something like 7, and then reassignning an SCL rating of 8 or higher to messages that are classified as Suspected Spam using the Symantec Spam Rating, otherwise it's hard to tell which program is catching a message.

The SAT can be set via the \Program Files\Symantec\SMSMSE\6.0\Server\SMSMSESAT.exe executable. Just run SMSMSESAT.exe from a command prompt with no arguments to see the current threshhold:

C:\Program Files\Symantec\SMSMSE\6.0\Server>SMSMSESAT.exe

SMSMSESAT.exe -- Symantec Mail Security for Microsoft Exchange Store Action Thre

shold Utility




Usage:

SMSMSESAT [sat] [/H hostname]

Gets and sets Store Action Threshold.

sat Store Action Threshold value to be set.

/H hostname Domain name, host name or IP address to connect.




Current value of Store Action Threshold = 7

You can set it via SMSMSESAT.exe [sat], where [sat] is the threshold value (eg 7).

Handling Spam

There are three main sections for handling spam under the Symantec Premium AntiSpam Actions configuration page:

Spam Messages

• These are the messages that have been given a Symantec Spam Rating of between 90 - 100. These messages will almost always be spam, I would recommend rejecting these, but turning on logging so that we can check if a client reports a rejection.

Suspected Spam and SCL

• This allows you to deal with messages that are Suspected Spam using the Symantec Spam Rating (default is 72), and also have a SCL rating above a certain level. At this stage I think a good default setting is to reject messages that are Suspected Spam using the Symantec Spam Rating, and have an SCL rating of >6, and logging the action. Microsoft recommend rejecting messages with an SCL rating of 7 or above (http://technet.microsoft.com/en-us/library/bb738130.aspx).
• If this turns out to be rejecting too many legitimate messages, you could either turn down the SCL rating level to >7 or >8, or alternatively accept the message but tick the "Assign SCL value to message" option and set it above the Store Action Threshold (this guide recommends 8). This will ensure that the message is delivered to the user's Junk Email folder, rather than their Inbox.

Suspected Spam

• This allows you to deal with messages that are Suspected Spam using the Symantec Spam Rating (default is 72), but don't have an SCL rating, or have an SCL rating lower than the threshold set in the ** Suspected Spam and SCL ** section.
• I would recommend accepting this message, but ticking the "Assign SCL value to message" option and set it above the Store Action Threshold (this guide recommends 8). This will ensure that the message is delivered to the user's Junk Email folder, rather than their Inbox.

Whitelisting

If there are domains/senders that the client usually receives legitimate mail from, you can whitelist domains or individual addresses so that no antispam action is taken against messages received from those domains/senders.

Conclusion

Again, all clients will be different, but I think this allows a good starting point to tweak from. Most spam will either be rejected or send directly to Junk Email. If there are reports of rejections or incorrectly classified mail, the actions can be tweaked, or the sender/domain being rejected/marked as spam can be whitelisted.