Nếu Outlook nhận được một tin nhắn e-mail không được thẩm định từ một nguồn bên ngoài, nó đánh giá các địa chỉ IP nguồn chống lại các danh sách Chấp nhận và từ chối và bác bỏ các thông báo nếu kết hợp được tìm thấy trên các danh sách từ chối. | 11-24 Chapter 11 Microsoft Exchange Server 2003 Security Evaluating E-Mail If Outlook receives an unauthenticated e-mail message from an external source it evaluates the source IP address against the Accept and Deny lists and rejects the message if a match is found on the Deny list. If the IP address is not on the Accept or Deny list Outlook evaluates the message against an RBL. If a match is found on the RBL then Outlook stops the message at the protocol level. Otherwise Outlook evaluates messages against any third-party anti-junk e-mail products or plug-ins configured at the transport layer. The third-party product analyzes the message and assigns it a Spam Confidence Level SCL value that indicates the degree to which the message can be considered unsolicited commercial e-mail. The SCL value is from 1 through 10 the lower the value the higher the probability that the message is junk mail. Outlook moves the e-mail message into the information store and based on the SCL value and Outlook s user settings it either delivers the message to a folder or deletes it. If you set Outlook s filter to Low it sends any message ranked below 4 to the Junk E-Mail folder. If you set the filter to High Outlook sends any message ranked below 7 to the Junk E-Mail folder. Guidelines for Securing Mailboxes When developing a strategy for securing Exchange Server 2003 mailboxes you should consider the following guidelines Prevent users outside your Exchange organization from receiving out-ofoffice e-mail messages You can configure the default SMTP policy or create SMTP policies on a domain-by-domain basis that do not reply to out-of-office messages or forward such messages to the Internet. Prevent users from receiving e-mail from unidentified domains or from predetermined domains You can configure virtual servers to deny messages from unidentified domains or from any domain that you select. Limit access to e-mail content by digitally signing and encrypting e-mail messages You can ensure
