Forum Discussion
eport why the mails were moved to the Junk
Thanks for the link.
How does the process for working with junk emails looks like? After the introduction of Exchange online, the number of false positives in junk emails is going up.
I can create whitelists and the email/domain bypass the span check. But I don't think this is a good idea.
Creating a whitelist is not a proper solution, as later on if this mailbox is infected and starts sending you spam, these spam will go inside your org.
I would recommend reviewing your organization SCL level
use the command Get-OrganizationConfig | select *scl* what is the number, the higher number, the more possible of emails marked as SPAM,
Did you review the Protection.microsoft.com
Review the policy Get-HostedContentFilterPolicy
Also you need to understand that no matter your configuration, you will still have a false positive, as sometime its not your problem more than its the sender problem, such as
- senders are embedding vbs in your email (they don't know)
- sender have a bad email server configuration, (No SPF ... )
- sender have IFRAM
Try the Report Message Add-in
These are the Powershell results.
PS C:\Users\123456> Get-HostedContentFilterPolicy
Name SpamAction HighConfidenceSpamAction IsDefault
---- ---------- ------------------------ ---------
Default MoveToJmf MoveToJmf True
PS C:\Users\123456> Get-OrganizationConfig | select *scl*SCLJunkThreshold
----------------
4I could learn a lot from you. Can you recommend me a good book about Exchange online?
Thanks a lotGo to Protection.microsoft.com and create a new policy that fits your organization's needs, it seems that you still using the basic one.
Also if you can dump one of the email headers from the junk here we might be able to help you in finding out why the emails are marked as junk, but usually due to an increase in SCL rate, which can be caused by the message content.
SCL level is set to 4 is the default one and seems to be fine.
for the learning, I am just like you, got a lot to struggle with and googling and reading, usually Microsoft site, even though their documentation is a bit boring, but it's fine
How is you process?
Die Kellegen senden Ihnen die Emails zu und sie analysieren die Header? Or is there a better way?