As part of a domain

Less secure, easy to manage

As a stand-alone server

More secure, more difficult to manage

As part of a workgroup

More secure, more difficult to manage

As a special perimeter forest

More secure and easy to manage but requires more hardware support (recommended for large enterprises)

Minimum number of servers

1

2

2

The Edge Transport server role cannot be installed on the same computer as the other server roles. In the single-server scenario, anti-spam agents are manually deployed on the Hub Transport server role. The Edge Transport server role is not installed.

Network isolation

No

No

Yes

Spam and malware are rejected before they enter the network only if the Edge Transport server role is deployed at the perimeter network.

Anti-spam agents installed by default

No

Yes

Yes

If the Edge Transport server role is not deployed, an administrator can enable anti-spam agents on the Hub Transport server role by running an Exchange Management Shell command. For more information, see How to Enable Anti-Spam Functionality on a Hub Transport Server.

Anti-spam user interface

Anti-spam user interface is not visible by default. It is enabled after anti-spam agents are deployed manually.

Visible by default

Visible by default

The Exchange Management Console provides a user interface for configuring the following:

• Anti-spam functionality
  
  
• Receive connectors
  
  
• Send connectors
  
  
• Transport rules
  
  

Internet e-mail processing

Internet e-mail processing is enabled only after you set the Internet usage type on the Receive connector, and create a new Send connector with the Internet usage type.

Yes

Yes

For more information, see How to Configure Connectors for Internet Mail Flow.

Connection Filtering

Yes

Yes

Yes

Connection filtering provides IP Block lists and IP Allow lists to protect against spam. For more information, see Connection Filtering.

Sender Filtering

Yes

Yes

Yes

Sender reputation is dynamically analyzed and updated over time. For more information, see Sender Filtering.

Recipient Filtering

Yes

Yes

Yes

Recipients are validated by using the global address list (GAL). For more information, see Recipient Filtering.

Microsoft Exchange EdgeSync service

Not applicable

Yes

Yes

Microsoft Office Outlook Safe Senders lists and the GAL are pushed in encrypted format to the network perimeter.

Sender ID

Yes

Yes

Yes

Sender ID is checked when e-mail is received and included in spam rating. For more information, see Sender ID.

Content Filtering (Intelligent Mail Filtering)

Yes

Yes

Yes

Regular Microsoft SmartScreen updates help counter spam and phishing threats. For more information, see How to Configure Anti-Spam Automatic Updates.

Spam confidence level

Yes

Yes

Yes

A spam confidence level (SCL) rating is assigned to a message, based on several factors. For more information, see Adjusting the Spam Confidence Level Threshold.

Anti-spam stamp

Yes

Yes

Yes

Messages are stamped with details of spam assessment. For more information, see Anti-Spam Stamps.

Back pressure and tarpitting

Yes

Yes

Yes

Back pressure and tarpitting protect against denial of service and directory harvest attacks. For more information, see the Understanding Back Pressure and the "Tarpitting Functionality" section of Recipient Filtering.

Two-tiered spam quarantine

Yes

Yes

Yes

An administrator can access the spam quarantine folder and release a message to its recipient. For more information, see Spam Quarantine.

Attachment Filtering

No

Yes

Yes

Attachments are removed based on size, content, or file type. For more information, see Attachment Filtering.

Forefront Security for Exchange Server

Yes

Yes

Yes

For more information, see Protecting Your Microsoft Exchange Organization with Microsoft Forefront Security for Exchange Server.