Exchange SpamAssassin SMTP Sink

How to use an Exchange SMTP Transport Event Sink to eliminate SPAM.

On my never ending quest for the elimination of SPAM, I've looked at a lot of products.  Most of the free Anti-Spam products that I've looked at work only with POP3 email, not Exchange based.

However, I was quite interested in SpamAssassin. SpamAssassin is a perl based spam filter program that  utilizes a series of rules to flag mail as Spam.  It's quite a robust program, having been used in the Unix world for many years.

There is a link off of the main SpamAssassin page regarding getting SpamAssassin to work in a Windows environment.  This work was done by Michael Bell, and while a little complicated, by following all the steps there, I was able to get SpamAssassin to run on a Windows machine.  Now, there are a couple of issues with this.

1. SpamD, the SpamAssassin Daemon, doesn't compile with normal perl, so you are forced to use SpamAssassin in serial mode.  This means that for each email that you test, a copy of Perl must be started.  A little bit of a bummer, but my mail server load is relatively light.
2. None of the community checking systems (DCC, Razor, Pyzor) work.
3. SpamAssassin creates a batch file that reads mail from stdin, and exports the resulting mail with additional headers in stdout. 

How in the heck would this work with Exchange?  Michael has done some more work on getting SpamD to work under Cygwin, but I wasn't quite ready to move to this.  The normal serial mode batch file would work, but how would you implement this with Exchange?

Michael did have a link on his system to a SMTP Sink written by Eric Smith. However, Eric obviously ran in to some of the more common problems with SMTP sinks - The CDO api is really poorly documented.  His script did the following:

1. Copy the Exchange message object to a common text file.
2. Run SpamAssassin with the common text file as input, outputting to another common file.
3. Parse the output file, hunting for the spam result.
4. If the message is spam, either change the subject line, or reject it.
5. If it is not spam, just exit.

While workable, this is really not taking advantage of all the capabilities if SpamAssassin, limited as the are in the Windows world.  I wanted to totally integrate SpamAssassin with the Transport Event Sink, so that for each message received, the sink would replace the original message with the one processed by SpamAssassin, just as originally intended. 

Thus I began my search on SMTP Transport Event Sinks and CDO.  I started off at the CDO for Windows MSDN site, which covered most of the basics for writing Event Sinks.  The sink that need to be implemented is the OnArrival sink.  Basically, my thoughts were the following:

1. Output the entire message object to a text file.
2. Process the text file with SpamAssassin.
3. Reload the resulting file into the current message object.
4. Parse the message object's headers for the SpamAssassin headers.
5. Archive the text message object to a Ham or Spam folder for later Bayesian evaluation.

After mucking around with a couple of sample scripts, I happened to read something about being able to access the message object as an ADO.Stream object.  Bingo!  So now, using the CDO Message's GetStream method, I could write the message object to a text file, and then using the ADO.Stream's LoadFromFile method I could reload the processed file! Instant SpamAssassin headers.

Usage:

To install the sink, download and install the ESA-setup program.  Note that you will need to have a working install of SpamAssassin on your Exchange server.

I've tried to have the install script do pretty much everything it can, but you will need to edit the INI file to point to the SpamAssassin.BAT file in your perl directory.

The Exchange SpamAssassin directory structure looks like this:

C:\ESA
├───Archive
│ ├───Ham
│ └───Spam
├───Ham
├───Logs
├───New
└───Spam

ESA-Setup will install the Sink for you, or you can run Install_ESA_Sink.bat.  To remove the Sink run Remove_ESA_Sink.bat.

Please see the ReadMe.txt for further instructions.

Thanks,

Chris Lewis (2004-04-13)

Download:

Installation program: ESA-setup.exe (317 KB )

Source Code: ESA-Source-2006-02-07.zip (61 KB)

Change Log:

Copyright and License:

This program and source code are Copyright © 2004-2006 Christopher G. Lewis.  All rights reserved.

The use and distribution terms for this software are covered by the Common Public License 1.0 (http://opensource.org/licenses/cpl.php) which can be found in the file CPL.TXT at the root of this distribution.
By using this software in any fashion, you are agreeing to be bound by the terms of this license.

You must not remove this notice, or any other, from this software.

References:

VamSoft: Scripts and Tools - Great notes on ISMTPOnArrival scripting.
Microsoft: MSDN CDO for Windows - API reference.
Michael Bell - For his 'USING SpamAssassin WITH WIN32' http://www.openhandhome.com/howtosa.html
Eric Smith - For his original VBScript http://www.cardboardutopia.com/ExchangeSpamFilter.zip
SpamAssassin Team - http://spamassassin.org/
Inno Setup - Jordan Russell's wonderful setup program. This setup tool ROCKS! http://www.jrsoftware.org/isinfo.php

Trademark Notice and Disclaimer:

Exchange® is a registered trademark of Microsoft Corporation.
Microsoft® is a registered trademark of Microsoft Corporation.
SpamAssassin™ is a trademark of Network Associates, Inc.

Send mail to Webmaster with questions or comments about this web site.
Copyright © 2003-2006 Christopher G. Lewis
Last modified: 12/30/06 by Chris Lewis