Forum Discussion

Jeff Harlow's avatar
Jeff Harlow
Iron Contributor
Oct 07, 2016

EOP Spam Policy - Move to Junk

I have a custom (default) EOP Spam policy for which all types of spam and bulk is set to "Move message to Junk Email Folder".  However cloud mailbox users non of these messages are being delivered to...
admin
exchange online
hybrid
Victor_Ungureanu's avatar
Victor_Ungureanu
Icon for Microsoft rankMicrosoft
Oct 07, 2016
Is this the only policy? Are you sure that no other policy is applied to those spam emails? Are the emails marked as spam (SCL>5)?

Attach the header of such an email that should have been delivered in three JMF.
  • Jeff Harlow's avatar
    Jeff Harlow
    Iron Contributor
    Oct 07, 2016

    Only one policy. Yes, Emails are being marked as spam (SCL 9). The BCL is 6.

     

    Including screenshot of policies.

     

    Some of the headers are below. Cannot attach multiple files to this.


    Reply-To: Windows IT Pro <reply@windowsitpro.com>
    Date: 7 Oct 2016 10:06:17 -0400
    Subject: {BULK: HIGH}Enterprise IT Event Agenda & Giveaways
    Content-Type: multipart/alternative;
     boundary=--boundary_361092_ea1e4143-7257-4260-b9e2-bb8a483142dd
    X-MS-Exchange-Organization-Network-Message-Id: 0e8f921d-88b6-4604-408e-08d3eebb2c17
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 020caa57-5a64-40d3-a4e7-c2b201ae4d3f:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Forefront-Antispam-Report: CIP:204.92.19.130;IPV:NLI;CTRY:CA;EFV:NLI;SFV:SPM;SFS:(8196002)(31620200002)(2980300002)(1060300003)(438002)(596005)(286005)(359002)(497574002)(189002)(349012);DIR:INB;SFP:;SCL:9;SRVR:BN6PR03MB2530;H:mail02.tech.pentontech.com;FPR:;SPF:Pass;PTR:mail02.tech.pentontech.com;MX:1;LANG:en;
    X-Microsoft-Exchange-Diagnostics: 1;BN1BFFO11FD006;1:/be9fCZTce9t5TCx0MpqbE0bkhUqCPot6utUf3uznzi3QYhdcoIkLbDlbrV3eKrHm4D0i04u9K+9WzBrWi32KsGBVz1rK5UFkWJwSINWT3BFYwAF1YyvvbJKBF+ru0WqK1qahjH+771yhye6D4+jUSCLKoNnDVG26//8CFXemNXorYbfRiL8AOnYNemZBBj2E4xvOK3J5vzecOxgFoR+d7ULIg+5fke+sNrK7Ea4U+yTdQ5fFxChhqPuDVUqhvg1YIGTTx8fENMhSPfO8uFZuqSLSPQyZjpP78eGkG/pKedRtIoRKkFAx0HWu3kuvtOD9PGp+8GPxNCpIH12dEhxcjsL8yVg9TPfweGrm8ZJCzl2njdvkt0lJYzTWxR5PElN3qwGO2Hqfu8LexN8m38DVfjog9/OFKv77vToqClKnXH2ZExCAmCRFA7I44eG0lomHiNiFQTHiMhdvoZqnBTMs6mPIY58ZWsWCxnvEhB1TPCv72tRYCQShah5D242utu/iJgv7GegLmIFX/Z2YB+re0pbpZiVp/3isfwpHINMFiB4zz6YCmxP0EAA6e6LA26zRviFfBLQ4fvHm+Vor4ZINunBksXtfW9atMPvRxYgk0Lcl14vztidBpFhAsRlmvhs
    X-MS-Office365-Filtering-Correlation-Id: 0e8f921d-88b6-4604-408e-08d3eebb2c17
    X-Microsoft-Exchange-Diagnostics: 1;BN6PR03MB2530;2:PlT7eIztWe3XBpb4H1YQZFECzvi1e+Gwn8NsStiuSGnaq7H7U9FpUBol0rab6RBTUjLiujCj3uaBePpDOoBkUvjDsch9L8KtOm9bllSPO1mu3N3gwUtl5ooXqTZ+JGfh5NyVQ5pJiNBwe28k5uZXNa4EtKqU2rSHxuGQYpUeWk3LwfOV+9n27pKTDL7VjBHpS5E7acGd+1dLwAmN0zMvog==;3:Njp3WunIdc/jPk04cljeTzG5VG2cQnzLf4JCPgolowBnTa+Ejt9rzZB0JATySO7Q5ZtFi2uA5GWQmK4k1M1rUmxbyOFwG3Fr4UTUjSsidR7LNXjBdLJ2K3+6dfrnJGUC+2n/mZqEnRwlq3rURrB1i5Ex5Jg1gvPZOJR/nTk0jCyaXdDKgu2WOsZigNVZc8N1/m2sD4PdXQXJgH9K7bfx+CYCdGUjeNswCXrOb8ItjpYq7TBLgl/9ataqGdEeb1KmEyVTvkAHGKm2/acED9zNc8nwaFcRawEWnRGP7hLYZ/GtTWcIfkSP/uF68CvCOU6NUO2YkHVJEKqGR34yVq6m5JNMYKGcI4XXUCXQ6T42Rl8gjihX9YQEzgL2YOC+NGIG
    X-DkimResult-Test: Passed
    X-Microsoft-Antispam: UriScan:;BCL:6;PCL:0;RULEID:(421252002)(8251501002)(3001016)(71701004)(71702002);SRVR:BN6PR03MB2530;
    X-Microsoft-Exchange-Diagnostics: 1;BN6PR03MB2530;25:vQ0l6T/dbvM2b6/I3/y4KeHUBF+IvETqYSFDzMquxpQn0IlIZ4KK5JwGsREgPe7q33IvSlPpU/FfWIKFeKXQflsM7iYJQnStRFpQZrS5JzQSuN8HVm3NyaO6g6Mg4sDPJpEylFhlmIsMHqhHaeQ3DQcydC/oXG3/6aaAplAkKB/zW8p1gZ2re7XfPKJ/Fw4oMoowxbkhz9cE9gWOi8FyS8cVpKEMRNVE/rYz4duL5nmlxQ2tmNJSMeWOvIYvkRwNKlB7pv60NIZ95mVG2iibzSkpKb0D/cNLuLNcYwmihiHfyeHJDvucQYmGtL72ifqAvWve6WKvs0NCtT/GKLDxbxxL29OMK9KqTmNrXyJuwxYpbW+7ZKeaXdpi00YuisGCjUNSdGfnf3+mwQPWS5Z1AGKETBATOiuXn38q4An3W1vEJ1NcJczuMbgsHhFHyGeC;31:cVlPc0rFlFJvCXNz0d0Idu7529dHTd8K6R7XQSbA6AUN5BfhTFOfUl4pp/NCx1PgJS1yb5crq+c+Ptr5KAEVNe+Tn3vwaT1wTh8RJp/zp6AUyhWqVc0eRf/LxjXsTknLzy/j24fYbDyA9DWi/rUCnydNTiRLydN+NAUBvC/atV1Wo6bqrgjN6TkXBnP2QpNFQza3V75ibFSqQFO3CZR9uufBaE/eIA2xphg5i6gs3ykFUEOMujYq5duFPrKDoMrIlWmxG3q5MFNr9kLtTxfNzg==
    X-MS-Exchange-Organization-AVStamp-Service: 1.0
    X-Microsoft-Exchange-Diagnostics: 1;BN6PR03MB2530;20:XPg1JGthFzWs20R5UBAZjzFx0xkQvR0lxJpAN2G1ovgYLtdD4Z1T5R7lI/0fAhnJlBAPiQSA3/hzpOmqBgXCmAV1e7CvvAYo189ZW66TxwU0WevMrnNrL8pifRjKdYFoYN36kf+QVmUk1CKPrGrykM3gtZBf4TIjam2BJd8vFaepMzuoBA1SuIn5fMZZivoQbAu0OHSDBDxmbsEvSm4nU0hfN6S/MvLTj3j70kPMql+mejffSNJ4CZVRzX8JycYFyvS2BrOxyAqAqc20sDnEaRpOKQ08MQ170O6WMT3WMHqChkwM/Vi7IgwU71/1Z7MqnIjEq3f/o7fAtiPis3nQHiPeTbwch9iTE1xx/0g35pvek5FYRFE7HdkXY1WL74FkuukQcjjGHrxJxzLWl/CKkI/OF9ysZtFiNBWOnNiniUM=
    X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(148322886591682)(116415991822766)(81227570615382);
    X-Exchange-Antispam-Report-CFA-Test: BCL:6;PCL:0;RULEID:(9101531078)(601004)(701104)(2401047)(8121501046)(13024025)(13018025)(1201001)(13016025)(9101536074)(3002001)(10201501046);SRVR:BN6PR03MB2530;BCL:6;PCL:0;RULEID:;SRVR:BN6PR03MB2530;
    X-Microsoft-Exchange-Diagnostics: 1;BN6PR03MB2530;4:aLpDX7vod9smwweaLfiRHYlAbV6/pecjKaYVwBkfcpFR4YgEzuH0mYzs2YsqUDBNy8hJ73KvY7aFa69Twny/pSU+Zrxxi5DVD7aFLPjO9US/HCgohO+ZvRgks2tF2qC4Rijj59QYxXg/fCpodgnzKIhg0i+WiInjGTR63wFw3iMmsc1Nkd/H61Ke3u0/9gzj3yTcv9uf6d3+mlL5dcpEmFiHAW0xhruCB/bVMHno2T6VaC+++y1hb4fQ6nMeOLgL9G+XDjis0Gje0K1XL6WWrl3IYDdAjUVFCWs3lDTFfuUHUAmPZ3CGcxjo4sH+Y07SsD52Oh2hDcrNbJDttNEWNlknOT2BOf7DKtZuJJ6xnprdsKX13PpkO1w73569eG8lVwuBHYKb3+CkrH7ldLLyyjpOdmZM9d0xE6l/iSzoAqtlG1S0zEtWZCPahR/tWJXe4ggf5U2C7th9DDKLmBTNCN+5PMJk4ElIFZNkRDJaMDTnLN+0Q3s8VhZLznunUG2V2ZRMv4IPuNxnhTH8eLZZB4zwL73j1MFLBNvtV+DBgybfFSyhnUcG4UggFtagVScQGlKUeKHCxoOyYznxkOL1/8GCZrjX9vlJVOyDZv9mDnC7wVq6Vl87Maizg00jRvGAg5k0dXS2UgqiZ1zWH2y4/g==
    X-MS-Exchange-Organization-SCL: 9
    X-CustomSpam: Bulk Mail | Bulk Mail

    • Victor_Ungureanu's avatar
      Victor_Ungureanu
      Icon for Microsoft rankMicrosoft
      Oct 07, 2016

      Indeed, the message is marked as spam and, according to your spam filter policy, it should be delivered in the junk mail folder. Maybe you have an Outlook addin or an inbox rule that puts thos emails in the inbox folder. You could try to send a Gtube test email (http://spamassassin.apache.org/gtube/) from a 3rd party mailbox to your O365 mailbox when Outlook is closed and use OWA to check if the email is delivered in junk.

      • Jeff Harlow's avatar
        Jeff Harlow
        Iron Contributor
        Oct 07, 2016

        I am glad to see someone agrees that this should be working. As far as Addin (Addons). I have only the basic addons, and addins I have Message Header Analyser, Yelp and Package Tracker. Addons: Exchange Add-in, SharePOint Server Collegue, VBA for Outlook, Scoail Connect and Skype Meeting Addons.  Rules, nothing concerning.

         

        To add, this happens to my co-worker, that is also in the cloud. On-Premise users seem to be fine or at least better. Which would seen to be the opposite as one has to create an On-Premise Transport Rule (which I have) to handle junk mail filting.

         

        Go Figure.

Resources