eG Monitoring
 

Measures reported by SenderIdAgTest

The Sender ID agent is an anti-spam agent that is enabled on computers that have the Microsoft Exchange Server 2007 Edge Transport server role installed. The Sender ID agent relies on the RECEIVED Simple Mail Transfer Protocol (SMTP) header and a query to the sending system's domain name system (DNS) service to determine what action, if any, to take on an inbound message.

Sender ID is intended to combat the impersonation of a sender and a domain, a practice that is frequently called spoofing. A spoofed mail is an e-mail message that has a sending address that was modified to appear as if it originates from a sender other than the actual sender of the message.

In essence, Sender ID asks a question: "Has this e-mail message been spoofed?" If the answer is "Yes, it has been spoofed," the Sender ID filter rejects or deletes the message immediately. If the answer is "No, we can confirm the sender's authenticity," the message is assigned a Sender ID status and transmitted to Intelligent Message Filter, if Intelligent Message Filter is enabled on the server, for additional anti-spam processing.

The steps in the Sender ID verification process are as follows

1. A sender sends an e-mail message to the receiver.

2. The receiver's inbound mail server receives the e-mail message and extracts the PRA.

3. The inbound mail server checks which domain claims to have sent the message, and examines the domain name system (DNS) for the sender policy framework (SPF) record of that domain. These SPF records identify authorized outgoing e-mail servers. The inbound server determines whether the sending e-mail server's IP address matches any of the IP addresses that are published in the SPF record.

4. If the IP addresses match, the e-mail message is authenticated and delivered to the receiver. If the IP addresses do not match, the e-mail message fails authentication and is not delivered.

Based on the evaluation of the Sender ID record, every message is stamped with a Sender ID status. Intelligent Message Filter considers this status for the final assignment of an SCL rating, if Intelligent Message Filter is enabled on the server and the status is also available as an output from the Sender ID filter.

This test reports statistics related to the anti-spamming activities performed by the Sender ID agent, and reveals its overall efficiency.

 The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
Messages_validated_rate Indicates the number of messages validated per second. Msgs/Sec  
Messages_with_no_PRA Indicates the number of messages per second that were detected as not having a valid PRA. Msgs/Sec When you enable Sender ID, each message contains a Sender ID status in the metadata of the message. When an e-mail message is received, the Edge Transport server queries the sender's DNS server to verify that the IP address from which the message was received is authorized to send messages for the domain that is specified in the message headers. The IP address of the authorized sending server is referred to as the purported responsible address (PRA). PRA is calculated based on the following message headers:
  • Resent-Sender:
  • Resent-From:
  • Sender:
  • From:
A high value of this measure indicates that the Sender ID agent has rejected many messages owing to an invalid PRA.
Msgs_validated_with_SoftFail_result Indicates the number of messages that were validated per second with a SoftFail result. Msgs/Sec Anti-spam stamps help you diagnose spam-related problems by applying diagnostic metadata, or "stamps," such as sender-specific information, puzzle validation results, and content filtering results, to messages as they pass through the anti-spam features that filter inbound messages from the Internet.

The Sender ID (SID) stamp is based on the sender policy framework (SPF) that authorizes the use of domains in e-mail. The SPF is displayed in the message envelope as Received-SPF. The Sender ID evaluation process generates a Sender ID status for the message. If the status returned is SoftFail then it means that the IP address of the sender may not be in the SPF. Softfail is considered less trusted than Neutral, where the sender ID verification check is inconclusive.
Msgs_validated_with_a_fail_non_existent_domain_result Indicates the number of messages that were validated per second with a Fail - Non-existent Domain result. Msgs/Sec  
Msgs_validated_with_a_fail_malformed_domain_result Indicates the number of messages per second that were validated with a Fail - Malformed Domain result. Msgs/Sec  
Msgs_validated_with_a_fail_not_permitted_result Indicates the number of messages per second that were validated with a Fail - Not Permitted result. Msgs/Sec  
Msgs_validated_with_a_none_result Indicates the number of messages per second that were validated with the result of None. Msgs/Sec The None result signifies that no published SPF data exists in the sender's Domain Name System (DNS).
Msgs_validated_with_a_TempError_result Indicates the number of messages per second that were validated with a TempError result. Msgs/Sec The TempError result denotes that a temporary DNS failure occurred, such as an unavailable DNS server.
Msgs_validated_with_a_neutral_result Indicates the number of messages per second that were validated with a Neutral result. Msgs/Sec The TempError result implies that Sender ID verification check was inconclusive.
Msgs_validated_with_a_pass_result Indicates the number of messages per second that were validated with a Pass result. Msgs/Sec A Pass result indicates that The IP Address and Purported Responsible Domain pair passed the Sender ID verification check.
Msgs_missing_originating_IP Indicates the number of messages for which the originating IP could not be determined. Msgs/Sec  
Msgs_validated_with_a_PermError_result Indicates the number of messages per second that were validated with a PermError result. Validates/Sec A PermError result indicates that The DNS record is invalid, such as an error in the record format.