Microsoft KB Archive/922217

= An unexpectedly large number number of spam messages are delivered when you use Microsoft Antigen together with a mail server that is published by ISA Server 2004 =

Article ID: 922217

Article Last Modified on 7/10/2006

-

APPLIES TO


 * Microsoft Antigen for Exchange
 * Microsoft Antigen for SMTP Gateways
 * Sybari Antigen 8.0 for Microsoft Exchange
 * Sybari Advanced Spam Defense 4.1
 * Sybari Advanced Spam Defense 4.0
 * Sybari Advanced Spam Defense 3.5

-





SYMPTOMS
When you run one of the following products, you may notice that an unexpectedly low number of unsolicited commercial e-mail (UCE) messages are detected.

Note UCE is also known as spam.
 * Microsoft Antigen 9.0 for Exchange
 * Microsoft Antigen 9.0 for SMTP Gateways
 * Sybari Antigen 8.0 for Microsoft Exchange
 * Sybari Advanced Spam Defense

When this behavior occurs, an unexpectedly large number of spam messages are delivered to the recipients' mailboxes.

You experience this problem if you use Microsoft Internet Security and Acceleration (ISA) Server 2004 to publish your e-mail server.



CAUSE
This problem occurs if the following option is set for the mail server publishing rule in ISA Server:

Requests appear to come from the ISA Server Computer

The Microsoft products that are mentioned in the &quot;Symptoms&quot; section use header information to help detect spam. Therefore, these products may miss some spam messages if the messages appear to come from the computer that is running ISA Server.



RESOLUTION
To resolve this problem, configure the mail publishing rule so that e-mail messages appear to come from the original client. To do this, follow these steps:
 * 1) Start the ISA Server Management tool.
 * 2) Expand , and then click Firewall Policy.
 * 3) Right-click the mail server publishing rule, and then click Properties.
 * 4) Click the To tab.
 * 5) Click Requests appear to come from the original client, and then click OK.
 * 6) Click Apply to update the firewall policy, and then click OK when the firewall policy has been successfully updated.



MORE INFORMATION
For more information about how to configure Microsoft Antigen 9.0 for Exchange, see the Microsoft Antigen for Exchange User Guide. To do this, visit the following Microsoft Web site:

http://www.microsoft.com/technet/antigen/2006/antigenforexchange/default.mspx

For more information about how to configure Microsoft Antigen 9.0 for SMTP Gateways, see the Microsoft Antigen For SMTP Users Guide. To do this, visit the following Microsoft Web site:

http://www.microsoft.com/technet/antigen/2006/antigenforsmtp/ch1.mspx

For more information about how to configure ISA Server 2004 to publish a mail server, visit the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/exchage2003.mspx

Keywords: kbtshoot kbfirewall kbprb kbspam KB922217

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.