Exchange FAQEmployee Resources

Forefront Online Security for Exchange FAQs

The State of Montana will be filtering spam with Forefront Online Security for Exchange to provide a better spam filtering product to the State of Montana Exchange users. This page is to provide users with answers to frequently asked questions. This is in initial phase and is being rolled out to small sets of customers at this time.

Unlike Espion which sends out consolidated reports once a day users will receive consolidated notifications that will be sent out every 3 days.  If users need to check their spam more frequently then every 3 days users can log into their Quarantine mailbox at anytime. 

At this time there is no way to customize report intervals for individual users other than to turn reports off.  So everyone who request reports will receive a report every three days.

There is an option on the FOSE portal for "Forgot Password?" that allows for user self-service.

The Safe Sender option in Outlook only handles the way Outlook makes decisions about routing messages to the junk E-mail folder.  It's not synchronized in any way with the interceptors, nor will it be with FOSE.  From the standpoint, nothing about FOSE changes the way Safe Sender works.

By default, users will be able to login to their spam quarantine and manage their own spam messages.  Service desk can access the quarantine of user calling in who requires help.

Spam notification can be turned off for individual accounts.  Users can make the change from within the Quarantine service by clicking Options located above the top menu bar. Users can then select the option to receive or not receive the send notifications. Once done click on Save to keep the changes.

When you use the "Not Junk" link, the message will be recovered to your Inbox, and a copy will be submitted to the FOSE Spam Team for analysis. FOSE will make the determination to allow or not allow the mail through.

Please send a copy of the message along with full internet headers to FOSE False Positive team at false_positive@frontbridge.com.

Please send a copy of the spam message to our Spam team at abuse@frontbridge.com.  One spam message per submission, please.  Submitting a group of messages in an attachment is not the best way as much of the original spam message can be lost. Instructions provided below for the specific clients on how to send the e-mail to the Spam team.

Office Outlook 98, 2000, XP, and 2003

  1. Open the message.
  2. On the View menu, select Options.
  3. Press CTRL+C to copy the text displayed in the Internet Headers window, and then close the Options window.
  4. Go back to the original e-mail and click the Forward button.
  5. Press CTRL+V to paste the headers into the top of the message. Leave a blank line between the headers and the message body.
  6. Send this e-mail to abuse@frontbridge.com.

Office Outlook 2007

  1. Open the message.
  2. On the Message tab, in the Options group, click the Dialog Box Launcher.
  3. In the Message Options dialog box, the headers appear in the Internet headers box.
  4. Select the text in the Internet Headers box, press CTRL+C to copy the text, and then close the Message Options window.
  5. Go back to the original e-mail and click the Forward button.
  6. Press CTRL+V to paste the header text into the top of the message. Leave a blank line between the headers and the message body.
  7. Send this e-mail to abuse@frontbridge.com.

Microsoft Office Outlook Web Access for Exchange Server 2007

  1. Log on to your Outlook Web Access account.
  2. In your Inbox, find the message that you want to submit.
  3. Double-click the message to open it in a new browser window.
  4. In the new window, click the Message Details icon.
  5. In the Message Details dialog box, copy all of the text in the Internet Mail Headers box, and then send the information to abuse@frontbridge.com.

If sending email to the State of Montana and you are notified you are on a blacklist for spam from Microsoft the notification will look like the example below. There was a SMTP communication problem with the recipient's email server. Please contact your system administrator.

NDR Blacklist notification from Microsoft that contain ##.blacklist.zap please follow the instructions below:

86.blacklist.zap This list is generated with data from the PBL and SBL public black lists which are ran by Spamhaus. In order to be removed from this list you will need to contact Spamhaus and request delisting. Once Spamhaus has removed your IP address from SBL or PBL our information will generally update within one to two hours.Spamhaus web site: http://www.spamhaus.org/

Spamhaus lookup site: http://www.spamhaus.org/lookup.lasso87.blacklist.zap. This list is generated with data from the XBL public black lists which is ran by Spamhaus. In order to be removed from this list you will need to contact Spamhaus and request delisting. Once Spamhaus has removed your IP address from XBL our information will generally update within one to two hours.Spamhaus web site: http://www.spamhaus.org/

Spamhaus lookup site: http://www.spamhaus.org/lookup.lasso 88.blacklist.zap & 85.blacklist.zap

For the fastest removal off of 85.blacklist.zap and 88.blacklist.zap please call 1-866-291-7726. The bounce message will contain the IP address and which blacklist you are on. This information is required for us to process the delisting request. Once received a delisting request will usually be resolved within 24 business hours.

For all other Blacklist NDR’s

  1. Find out what blacklist(s) you are on.
  2. Visit the website that corresponds to that blacklist.
  3. Read the FAQ and other information on that website.
  4. Follow any instructions given.

You can use online tools to see if you are listed such as the example below:

http://www.mxtoolbox.com/blacklists.aspx

In addition to monitoring the blacklists, it is also advisable to monitor Google Groups (Usenet discussion forums) for the name of your site, limiting your search to only the news.admin.net-abuse groups, to see if it lists any spam reports for your domain: http://groups.google.com/groups?group=news.admin.net-abuse

Note: If there is a specific spam report containing your domain and you have not sent spam, it is possible that the email address has been spoofed. That means that the email "From" field was forged by a spammer, so it would look as if it had originated from your site.