Where to install IMF (and other miscellaneous IMF explanations)...

  • Article

Intelligent Message Filter (IMF) has been a hot topic since it was released to the web last week. I've seen a few questions fly by, and had a few directed at me so let's talk about some of the basics many of you may be wondering.

First, let's talk about how IMF works. There are two aspects to IMF: Gateway action, and Store action.

Gateway actions only happen on the machine where IMF is installed, and it is the process of scanning the message and tagging it with an SCL value. An action is defined, based on the SCL value returned by IMF (delete, reject, archive, or "no action").

If and only if the message makes it past the gateway, it will eventually be delivered (with SCL attached) into the Exchange mailbox store. If this mailbox store is running Exchange 2003 (RTM or SP1), a second determination will take place. Based on the Store threshold set through the IMF GUI, the message will be dropped into either the Inbox or moved to the Junk E-mail folder as a server-side store action. This requires no interaction with Outlook, so it will happen with any version of Outlook or OWA that you are using, as long as the Junk E-mail folder exists in your mailbox. (* - Note: Outlook 2003 safe lists and Junk E-mail settings can override this server-side behavior)

Conversely, if your mailbox server is Exchange 2000 or Exchange 5.5, it won't be able to do the store action, regardless of what version of Outlook you're running and any Junk E-mail action would still have to be performed client-side.

So, what's the principle take-away from this? You only need to install IMF at the Internet gateway. No need to install IMF on each and every Exchange 2003 mailbox store in the organization. If the SCL has been tagged onto the message at the gateway, it'll be handled by the store-side action when it hits the Exchange 2003 mailbox store without any need to have the IMF evaluate it again.

Also, a question came up about clusters -- IMF can't be installed on clustered Exchange servers and some folks wanted to know why. There are conflicts with the way SMTP protocol virtual servers are configured on cluster and the required bindings for IMF. This combination was not tested, as internet bridgehead servers are not generally run as clustered Exchange servers.