Explanation/Reference:
I think the correct answers are Sender ID - Content Filtering - Sender Filtering - Recipient Filtering
Content Filtering - Content filtering provides another tool to help manage the flow of messages entering and exiting your enterprise mail stream. Content filtering enables you to filter messages using a variety of filtering tools. These include: Sender-domains filtering (for Realtime and Manual scan jobs), Subject line filtering (for Realtime and Manual scan jobs).Filter set templates (simplify the creation and management of file and content filters on all scan jobs)
Sender ID -The Sender ID Framework is an e-mail authentication technology protocol that helps address the problem of spoofing and phishing by verifying the domain name from which e-mail messages are sent. Sender ID validates the origin of e-mail messages by verifying the IP address of the sender against the alleged owner of the sending domain. Now adopted by more than 10 million domains worldwide, Sender ID is providing brand owners, senders, and receiving networks with significant business and technical value
Sender Filtering -The Sender Filter agent is an anti-spam filter that's enabled on computers that have the Microsoft Exchange Server 2010 Edge Transport server role installed. The Sender Filter agent relies on the MAIL FROM: SMTP header to determine what action, if any, to take on an inbound e-mail message. When you configure anti-spam filters on an Edge Transport server, the filters act on messages cumulatively to reduce the number of unsolicited messages that enter the enterprise. For more information about how to plan and deploy the anti-spam features, see Understanding Anti-Spam and Antivirus Functionality. The Sender Filter agent acts on messages from specific senders outside the organization. Administrators of Edge Transport servers maintain a list of senders who are blocked from sending messages to the organization. As an administrator, you can block single senders (
[email protected]), whole domains (*.contoso.com), or domains and all subdomains (*.contoso.com). You can also configure what action the Sender Filter agent should take when a message that has a blocked sender is found.
You can configure the following actions:
-The Sender Filter agent rejects the SMTP request with a "554 5.1.0 Sender Denied" SMTP session error and closes the connection.
-The Sender Filter agent accepts the message and updates the message to indicate that the message came from a blocked sender. Because the message came from a blocked sender and it's marked as such, the Content Filter agent will use this information when it calculates the spam confidence level (SCL).
Recipient Filtering - The Recipient Filter agent blocks messages according to the characteristics of the intended recipient in the organization.
The Recipient Filter agent can help you prevent the acceptance of messages in the following scenarios:
-Nonexistent recipients You can prevent delivery to recipients that are not in the organization's address book. For example, you may want to stop delivery to frequently misused account names, such as
[email protected] or
[email protected].
-Restricted distribution lists You can prevent delivery of Internet mail to distribution lists that should be used only by internal users.
Mailboxes that should never receive messages from the Internet You can prevent delivery of Internet mail to a specific mailbox or alias that is typically used inside the organization, such as Helpdesk.
The Recipient Filter agent acts on recipients that are stored in one or both of the following data sources:
-Recipient Block list An administrator-defined list of recipients for which inbound messages from the Internet should never be accepted.
-Recipient Lookup Verification that the recipient is in the organization. Recipient Lookup requires access to Active Directory directory service information that is provided by EdgeSync to Active Directory Application Mode (ADAM).
Sender Reputation -Sender reputation weighs each of these statistics and calculates an SRL for each sender. The SRL is a number from 0 through 9 that predicts the probability that a specific sender is a spammer or otherwise malicious user. A value of 0 indicates that the sender isn't likely to be a spammer; a value of 9 indicates that the sender is likely to be a spammer.
You can configure a block threshold from 0 through 9 at which sender reputation issues a request to the Sender Filter agent, and, therefore, blocks the sender from sending a message into the organization. When a sender is blocked, the sender is added to the Blocked Senders list for a configurable period. How blocked messages are handled depends on the configuration of the Sender Filter agent.
The following actions are the options for handling blocked messages:
-Reject
-Delete and archive
-Accept and mark as a blocked sender
-If a sender is included in the IP Block list or Microsoft IP Reputation Service, sender reputation issues an immediate request to the Sender Filter agent to block the sender. To take advantage of this functionality, you must enable and configure the Microsoft Exchange Anti-spam Update Service.
By default, the Edge Transport server sets a rating of 0 for senders that haven't been analyzed. After a sender has sent 20 or more messages, sender reputation calculates an SRL that's based on the statistics listed earlier in this topic.
