Sender ID

You may already know that Exchange 2003 SP2 includes a new feature for SenderID support.  SenderID (http://www.microsoft.com/senderid) is the e-mail authentication framework that targets one of the most common security issues in the world of SMTP message transfer, which is spoofing.   In short Sender ID allows administrators of an e-mail domain to protect the identity of this e-mail domain by registering the special DNS record, also called SPF record, that lists the hosts (IP addresses, names, etc) that are authorized to send e-mail from that domain.  For example the SPF record for @microsoft.com e-mail domain lists about 20 authorized hosts. You can pre-view the record by doing  “nslookup –q=TXT Microsoft.com” and then “nslookup –q=TXT _spf.microsoft.com”.

So Exchange 2003 SP2 allows to query Internet DNS for SenderID/SPF records for the given domain mentioned as the sender domain in an e-mail message and then, depending on the result of that check, take appropriate actions on that message,.  The action could range from blocking the message at the protocol level (for example when SenderID check returns the “Failed” status) or passing the message to the next layer of filtering such as Intelligent Message Filter which takes the SenderID check result into account when making its anti-spam analysis decisions.

To give you the taste what SenderID check can accomplish let’s take a look at the following table of possible SenderID results that can be returned for a given message.

• Stamp and Continue - means acknowledge message acceptance and use SenderID check result in further filtering (such as IMF anti-spam)

• Reject – means respond with the 550 SMTP error code.   In this case the generation of the Non-Delivery Report (NDR) becomes the responsibility of the sending server.

• Delete – means acknowledge message acceptance and then turf the message.

Other SenderID check results are also helpful because they can show varying degree of trust that you have for messages entering your environment, depending if they come from an “authorized” or “prohibited” IP’s.

While all the above is interesting, some people (such as e-mail administrators) may want to see the SenderID result for messages sitting in their mailbox.  This can be used for troubleshooting or testing purposes or perhaps for building client side rules that take SenderID check into account.  It turns out with a few simple steps this becomes possible.  When the Exchange 2003 SP2 evaluates the SenderID status of the message, the result is added to the message as a mailmsg property and persists from Exchange Server to Exchange Server inside the X-EXCH50 blob.  When the message arrives to the mailbox server, Sender ID status is converted to a server side MAPI property. 

In the next steps we’ll try to visualize this MAPI property (0x40790003) in our Outlook 2003 client.  While there are multiple ways of doing it, let’s follow the approach that some of you may have used for visualizing the SCL value in Outlook. (http://blogs.technet.com/exchange/archive/2004/05/26/142607.aspx)

Copy the below text into a new text file as SenderID.CFG (in the same location as the .ICO files, usually Program Files\Microsoft Office\Office11\forms\language ID).

Now you are able to correlate the numeric status code to the SenderID result using the following table:

As the last step, for those of us who prefer labels instead of numbers, Outlook allows you to create custom fields based on the formula.  To do that, follow the following steps.

1. Right-click on the Column headings in your folder where you enabled SenderID field and choose "Field Chooser"

2. In the Field Chooser, click New.  Type SID as the field name, use Formula as the Type.  In the Formula field copy&paste the following (without the quotation marks)
   1. “IIf([SenderID]=1,"NEUTRAL",IIf([SenderID]=2,"PASS",IIf([SenderID]=3,"FAIL",IIf([SenderID]=4,"SFAIL",IIf([SenderID]=5,"NONE",IIf([SenderID]=-2147483641,"PERM_ERR",IIf([SenderID]=-2147483642,"TEMP_ERR",[SenderID])))))))”

3. Click OK and Drag&Drop the newly created SID field into your column headings.  You can hide the original SenderID field now by dragging it out of the column headings.

Obviously the form makes sense to install if you have Exchange 2003 SP2 in your environment and have SenderID checks configured on your gateway.

- Konstantin Ryvkin