Connection Filters Test

IP Block List provider services compile lists of IP addresses from which spam has originated in the past. Additionally, some IP Block List providers provide lists of IP addresses for which SMTP is configured for open relay. There are also IP Block List provider services that provide lists of IP addresses that support dial-up access.

You can configure multiple IP Block List provider configurations by using the Exchange Management Console or the Exchange Management Shell.

When you configure the Connection Filter agent to use an IP Block List provider, the Connection Filter agent queries the IP Block List provider service to determine whether a match exists with the connecting IP addresses before the message is accepted into the organization. The value of this measure indicates the number of connections that the filtering agent has established with the IP Block List provider service to perform such queries.

When you use the Connection Filter agent, it is a best practice to use one or more IP Block List providers to manage access into your organization. However, there may be some disadvantages to using an IP Block List provider. Because the Connection Filter agent must query an external entity for each unknown IP address, outages or delays at the IP Block List provider service can cause delays in the processing of messages on the Edge Transport server. In extreme cases, such outages or delays could cause a mail-flow bottleneck on the Edge Transport server.

The other disadvantage of using an external IP Block List provider service is that legitimate senders are sometimes added to the IP Block lists of IP Block List providers by mistake. Legitimate senders can be added to the IP Block lists that are maintained by IP Block List provider as the result of an SMTP misconfiguration, where the SMTP server was unintentionally configured to act as an open relay is an example of such a misconfiguration.

IP Allow lists are sometimes referred to as IP safe lists or "white" lists elsewhere in the software industry. IP Allow List providers maintain lists of IP addresses that are definitively known not to be associated with any spam activity. When an IP Allow List provider returns an IP Allow match, which indicates that the sender's IP address is more likely to be a reputable or "safe" sender, the Connection Filter agent relays the message to the next agent in the anti-spam chain.

The value of this measure indicates the number of connections the filtering agent has established with an IP allow list provider for checking whether the source IP address exists therein.

By using administrator-defined IP Allow lists and IP Block lists, you can configure connection filtering to support the following scenarios:

• To exempt IP addresses from the IP Block lists of IP Block List providers:   You may have to exempt IP addresses from the IP Block lists of IP Block List providers when legitimate senders are unintentionally put on an IP Block List provider's IP Block list. For example, legitimate senders could be unintentionally put on an IP Block list when an SMTP server was unintentionally configured to act as an open relay. In this scenario, the sender will probably try to correct the misconfiguration and remove their IP address from the IP Block List provider's IP Block list.
  For more information about IP Block List providers, see "IP Block List Providers" later in this topic.
• To deny access from IP addresses that are a source of unsolicited e-mail messages but are not found on an IP Block List provider's IP Block lists:   Sometimes, you may receive a large quantity of unsolicited messages from a source that was not yet identified by a real-time block list (RBL) service to which you subscribe.