Forum Discussion

RNalivaika's avatar
RNalivaika
Iron Contributor
Jul 08, 2020
Solved

Transport rule for authenticated sender

Hello exchange transport and EOP experts. I have a transport rule in exchange online. The rule says that messages from authenticated sender "randomdude@somecompanynamehere.com" should bypass spam fi...
exchange online
Exchange Server
  • RNalivaika's avatar
    RNalivaika
    Jul 09, 2020

    VasilMichevThanks for the input. I might just have found the answer..

    Ran Extended message trace and found this "DefaultFolderType:JunkEmail-Mailbox Rules Agent" in the column "recipient_status".

    Checked recipient mailbox and found inbox rules that check for some random words in message body  and move the message to Junk Mail folder. This was probably in place as a form for protection against spam in pre-EOP times.

    Removed the inbox rule, hoping the problem is solved.

    And i now notice the difference in headers between messages that were affected by this rule.

    Message in inbox: X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I

    Message in junk: X-Microsoft-Antispam-Mailbox-Delivery: ucf:1;jmr:0;auth:0;dest:J;OFR:CustomRules

    Would be nice to see X-Microsoft-Antispam-Mailbox-Delivery documented, but this is probably not happening soon. 🙂 BR, Ruslan

     

Degason's avatar
Degason
Copper Contributor
Dec 24, 2021

X-Microsoft-Antispam-Mailbox-Delivery | wl:1;pcwl:1;ucf:1;jmr:0;auth:0;dest:I;OFR:CustomRules;ENG:(910001)(944506458)(944626604)(920097)(810001)(250001)(410001)(930097);

 

Whenever you see the above red (OFR:CustomRules) in the message header analyzer and there is no inbox rule configured on the mailbox. Check and confirm if the recipient is using a Mobile phone to access the mailbox. If yes, then the sender of the email has been added to the block list of the recipient on the mobile phone.