Enable Exchange 2010 Anti-Spam Functionality on a Hub Transport Server

Important:
Most Exchange 2010 documentation does not refer to the anti-spam features in the context of the Hub Transport server. Therefore, as you read documentation about how to configure, manage, and maintain anti-spam features, remember that all functionality that is documented in the context of the Edge Transport server is also available on the Hub Transport server, unless specifically noted otherwise.

 Before You Begin

To perform the following procedures, the account you use must be delegated the following:

• Exchange Server Administrator role and local Administrators group for the target server
  

For more information about permissions, delegating roles, and the rights that are required to administer Exchange Server 2010, see Important: Update for Permissions in Exchange 2010.
The Install-AntispamAgents.ps1 script is copied to the %system drive%/Program Files\Microsoft\Exchange Server\Scripts folder. You must run the script from this location.

 Procedure

To enable anti-spam functionality on a Hub Transport server

1. Run the following command:
   
   ./install-AntispamAgents.ps1

2. After the script has run, restart the Microsoft Exchange Transport service by running the following command:
   
   Restart-Service MSExchangeTransport

 Setting the InternalSMTPServers Parameter

In some organizations, the Hub Transport server role is installed on computers that don't process Simple Mail Transfer Protocol (SMTP) requests directly on the Internet. In this scenario, the Hub Transport server is behind another front-end SMTP server that processes inbound messages directly from the Internet. The Connection Filter agent must be able to extract the correct originating IP address from the message. To extract and evaluate the originating IP address, the Connection Filter agent must parse the Received headers from the message and compare those headers with the known SMTP server in the perimeter network.
When an RFC-compliant SMTP server receives a message, the server updates the message's Received header with the domain name and IP address of the sender. Therefore, for each SMTP server that is between the originating sender and the Hub Transport server, the SMTP server adds an additional Received header entry.
You must specify all internal SMTP servers on the transport configuration object in the Active Directory directory service forest before you run connection filtering. Specify the internal SMTP servers by using the InternalSMTPServers parameter on the Set-TransportConfig cmdlet. For more information about how to use the Set-TransportConfig cmdlet, see Set-TransportConfig.
When messages are received by the computer that runs connection filtering, the IP address in the Received header that does not match the IP address of an SMTP server in your perimeter network is assumed to be the originating IP address.