Tag: email

I set the SCL value through Exchange-based rules. The rules are applied correctly when the desired conditions are met and the SCL value is properly set, as specified in message headers. In addition, the SCL set of values ​​(6) corresponds to the Junk SCL threshold (default 5).

However, the Exchange server does not put a message in the junk folder.

I'm either looking for a hint, which may be wrong, which could disrupt the proper workflow. Or any tips on further diagnostic steps to be performed.

Currently, I'm introducing a migration to Exchange 2016 in the following scenario (sample values):

1. DNS MX record forwards the sender to the old server.
2. The old server performs spam analysis through SpamAssassin and adds appropriate headers to the message, including X-Spam-Score,
3. Messages to recipients who are not known to old servers (for example, migrated mailboxes) are routed to Exchange.
4. Exchange applies a rule X-Spam-Score Head value, matching pattern [+]{4} (four or more + Characters that are equivalent to 4.0+ Score), SCL level on 6,

The exact configuration of the rule (based on Get-TransportRule Display):

HeaderMatchesMessageHeader: X-Spam Score
HeaderMatchesPatterns: {[+]{4}}
SetSCL: 6

I know that this works as far as the received messages with X-Spam-Score matching the pattern you get the X-MS Exchange Organization SCL: 6 Header.

However, the message ends up in the inbox and is not forwarded to the junk folder 🙁

Sample result set of headers in the submitted message:

X-Spam Score: 8.0 (++++++++)
X-MS Exchange Organization SCL: 6
X-MS Exchange Organization AuthSource: mbx-a.example.com
X-MS Exchange Organization AuthAs: Anonymous
X-MS Exchange Transport EndToEndLatency: 00: 00: 01.0250276
X-MS-Exchange-by-BccFoldering: 15.01.1531.003

The above configuration is essentially an analog of the standard Exchange Online Protection configuration in which the EOP server can be considered the equivalent of an old server with SpamAssassin. In this regard, the EOP documentation suggests a very similar configuration that differs only in the source headers used to determine message status. The additional deployment schedule requires that EOP be deployed before the old server, and then remove the old server with its spam protection role.

The server configuration relative to the SCL thresholds for Junk / Delete / Reject has been essentially a standard, in detail:

Get-OrganizationConfig:

SCLJunkThreshold: 4

Get-ContentFilterConfig:

SCLRejectThreshold: 7
SCLRejectEnabled: True
SCLDeleteThreshold: 9
SCLDeleteEnabled: Wrong
SCLQuarantine Threshold: 9
SCLQuarantineEnabled: False

The Exchange setup does not include any Edge Transport servers. Mailbox servers do not install / enable AntiSpam agents. However, there is no such requirement in the Microsoft documentation, such as: