Blocking Spam Domains in Exchange

There are a few things you need to know about blocking Spam in Exchange 2000 and Exchange 5.5. I'll go over them in the following order:

1. The GUI
2. Bypassing the GUI in
- Exchange 5.5 (Regedit)
- Exchange 2000 (ADSIEdit)
3. Finding a good block-list
-------------------

1. The GUI

To set up domain blocking in the Exchange 5.5 GUI, open Exchange Admin and go to the Connections object. Open the Properties for the Internet Mail Service object. Go to the Connections Tab and choose Message Filtering. You can manually enter domains or user accounts that you want blocked. If you want to block all mail from, for example, "narstygurls.com" you would enter the string "@narstygurls.com". If you want to block mail from "venom@boyscoutcabal.net" you would just type in that address.

When you've finished entering the addresses, Apply your changes, and then stop and restart the Internet Mail Service service on your server.

But there are easier ways to enter all the domains you'd want to block, and I'll show you how to do this now.
----------------

Bypassing the GUI

Rather thank typing the hundreds of addresses in to the GUI individually, it would be best to be able to paste a whole list in.

--------------------------
**** For Exchange 5.5 ****

Copy the block list.

Open regedt32 on your Exchange server.

Go to HKLM\CurrentControlSet\Services\MSExchangeIMC\Parameters and find the TurfTable key. Open it and paste.

Restart the Internet Mail Service

---------------------------
**** For Exchange 2000 ****

To put the block list into Exchange 2000, you will need to use ADSIEdit and find the following attribute, then add the list into the Value field.

ms-Exch-Turf-List-Names Attribute

Attribute Value
adminDescription ms-Exch-Turf-List-Names
adminDisplayName ms-Exch-Turf-List-Names
attributeID 1.2.840.113556.1.4.7000.102.12534
attributeSyntax 2.5.5.12
isMemberOfPartialAttributeSet FALSE
isSingleValued FALSE
lDAPDisplayName msExchTurfListNames
cn ms-Exch-Turf-List-Names
oMSyntax 64
objectCategory CN=Attribute-Schema,<SchemaContainerDN>
objectClass attributeSchema
schemaIdGuid oG2DCyA70xGqbwDAT47t2A==
searchFlags 0

---------------------------

For a good block-list you can check thread10-203769 for a list to copy or go to the black list that Shane Scanlon put together at http://www.msu.edu/~scanlon3/spam_black_list.txt

For a good real-time spam-blocking tool, I recommend IHateSpam, which Sunbelt Software sells. I think they have a trial version available.

Hope this was helpful.

ShackDaddy