Bounce backs and error codes for email can be very mysterious and misleading. To help with that we have started a new series on the blog dedicated to demystifying these mysteries. To read all of the blogs in this series, go here.

This is an error that our customers run into pretty often here are MxToolBox so we thought we would help explain the cause and provide some solutions to remedy it. By default Microsoft either installs/or recommends that the Intelligent Message Filtering (IMF) service be enabled on all installations of Exchange.

While the IMF can be somewhat helpful, it can be a detriment if you as the administrator don’t remember or even realize that it was installed on the server in the first place.  This can be especially troublesome when you have an additional 3rd party filtering service in place.  If you have IMF installed it essentially means you are double filtering your mail, once at the 3rd party spam filter and once at the Exchange Server. In cases that a 3rd Party Filtering is in place we typically recommend disabling the IMF feature. This is of course just a recommendation and you should do whatever you feel is best for your network environment.

How Does the IMF Identify Messages as Spam?
When a message reaches an Exchange Server with IMF installed, IMF will evaluate the textual content of the messages and then assign the message a Spam Confidence Level (SCL) rating from 1-9 based on the probability the message is Unsolicited Commercial Email (UCE).  This rating is then compared to the threshold set under Message Delivery Properties > Intelligent Message Filter in the Exchange System Manager.

How Do I Find Messages in the IMF?
Theoretically the IMF is supposed to place messages that it found as spam in your Outlook Junk Folder. Unfortunately, this doesn’t always tend to be the case.  If you have reports that messages are “missing” on your server and you can’t find them, check the IMF! To check this service, you will need to make sure that you have the Archiving option enabled. You can view the *Archived folder location here: C:program files[YOUR SERVER]mailroot[SMTP VIRTUAL SERVER]ucearchive.

*To view these archived messages you will need to download and install a 3rd-party tool.  If you have any recommendations regarding these tools, please leave them in the comments below.

Where is IMF installed?
When IMF is installed a new tab is added to the Exchange System Manager. For Exchange 2003, the tab is under Message Delivery > Properties under Global Settings.

There is also a new Intelligent Message Filtering node under Protocols > SMTP – This is where you enable IMF.

For Exchange 2007, it is under Exchange Management Console Server Configuration > Hub Transport > Anti – Spam.

As you may be aware, the native spam-filtering features in Exchange are typically too basic for most organizations.  While there is no question that IMF can improve Exchange’s ability to catch spam, you shouldn’t rely solely on this feature.  The IMF feature in Exchange simply cannot live up to the advanced heuristic spam, virus and phishing protection and controls featured in modern anti-spam and anti-virus products and services such as our own Spam and Virus Business Email Protection. We also include these services in our Email Hosting services.

Additional Sources:
http://technet.microsoft.com/en-us/library/bb266926(EXCHG.65).aspx
http://www.msexchange.org/tutorials/microsoft-exchange-intelligent-message-filter.html
http://support.microsoft.com/kb/867633