Antispam Protection: Exchange IMF or Forefront?

With Exchange 2007, Microsoft offers customers two Exchange-based options for blocking spam: the built-in Intelligent Message Filter (IMF) and Forefront Security for Exchange Server 2007 (FSE), a fee-based Exchange 2007 add-on which can block spam in addition to providing antivirus protection for e-mail. Deciding on whether to use FSE for spam filtering may be influenced by whether the customer has purchased the new Exchange 2007 Enterprise Client Access Licenses (CALs), which give users the right to use certain new Exchange 2007 features, such as unified messaging. These CALs, if purchased with Software Assurance, give the organization rights to run FSE at no extra charge. (See the chapter “Packaging, Licensing, and Pricing“.)

Which Is Best for Antispam?

For spam protection, FSE offers several benefits not provided by the Exchange 2007 IMF. While the IMF uses only heuristic rules to look for patterns that classify the likelihood that a message is spam, FSE not only uses heuristics but also connects multiple times a day to Microsoft and downloads signatures of known spam and IP addresses of known spammers. This information allows FSE to identify some spam deterministically rather than relying on heuristics alone.