We use Trend Micro ScanMail for Exchange (SMEX) in conjunction with the existing mail filtering services built into Exchange 2010. This service is provided as part of our Hosted Exchange mailbox service and is not available as a stand alone service.
The mail filter works by identifying the "chance" of a mail being spam and gives it a spam confidence level (SCL). This is a score from 0 to 9 with 9 being definite spam all the way down to 0 which definitely not spam. The following actions are taken on messages based on their score
Messages with a score of 9 are accepted and deleted at the Edge Transport server. This improves the changes that the message will not be resent by the spammer and ensures the message doesn't distract the end user.
Message with a score of 7 or 8 are rejected at the Edge Transport. The sender will get a Non-Delivery message. This allows for the sender to diagnose if a legitimate email fails to be delivered and also ensures the end user isn't distracted by unwanted emails.
Messages with a score of 5 or 6 are delivered into the end users Junk E-Mail folder. This allows the end-user to screen messages that are likely to be spam but in some cases may be legitimate emails. Outlook has a Junk feature that allows for the blocking and accepting of messages based on an email address, mail domain or other criteria. These actions are loaded into the Exchange server so future actions happen regardless of whether the users Outlook client is open.
Any other messages are delivered into the end-users mailbox where they will appear in their Inbox or another folder if message rules apply. In some cases these may be unsolicited email messages as it is not always possible to identify a message as being unsolicited just by its content. Again the Outlook Junk option allows for additional filtering to be applied to messages that fit this category. By putting some of the power at the end-users control a more accurate mail filtering process can be achieved.
SMEX will also scan attachments and email URLs and remove obvious bad links, viruses and malware attachments if they match known signatures. We check for updates to the SMEX virus, spam and malware signatures hourly so they are up to date.
Please make sure your staff know to check their Junk E-Mail folder for messages that appear to have not been delivered. Our system logs all messages delivered to our Edge Transport servers and this includes message identified as definite Spam so we can help diagnose an undelivered message if it has been rejected or deleted by our system.