Exposing SCL (Spam Confidence Level) in Outlook
Published May 26 2004 02:58 PM 32.5K Views

When making decisions on what SCL levels to set in the Intelligent Message Filter (IMF) configuration, it’s useful to see what SCL is stamped on particular mail.  The deployment doc describes how to expose the SCL through an x-scl header when archiving messages in Chapter 6, “Storing the SCL Rating with Archived Messages”.  This allows you to determine the correct settings to set for the Archive directory.  But the SCL property isn’t exposed to the end user when they try to determine why either a non-UCE message was in the junk mail folder, or why a large number of UCE messages aren’t being blocked before they arrive in the Junk-Mail folder.  Just because the property isn’t exposed, doesn’t mean it can’t be though!

The following is an Outlook configuration file provided by Paul Bowden that will allow you to configure Outlook to expose the SCL property.  Copy the SCL.CFG text and save it as SCL.CFG (in the same location as the .ICO files, usually program files\...\office 11\forms\language ID), then follow the instructions below to install it.

SCL.CFG:

;**********The CFG file**********
[Description]
MessageClass=IPM.Note
CLSID={00020D31-0000-0000-C000-000000000046}
DisplayName=SCL Extension Form
Category=Standard
Subcategory=Form
Comment=This forms allows the SCL to be viewed as a column
LargeIcon=IPML.ico
SmallIcon=IPMS.ico
Version=1.0
Locale=enu
Hidden=1
Owner=Microsoft Corporation
Contact=Your Name
[Platforms]
Platform1=Win16
Platform2=NTx86
Platform9=Win95
[Platform.Win16]
CPU=ix86
OSVersion=Win3.1
[Platform.NTx86]
CPU=ix86
OSVersion=WinNT3.5
[Platform.Win95]
CPU=ix86
OSVersion=Win95
[Properties]
Property01=SCL
[Property.SCL]
Type=3
NmidInteger=0x4076
DisplayName=SCL
[Verbs]
Verb1=1
[Verb.1]
DisplayName=&Open
Code=0
Flags=0
Attribs=2
[Extensions]
Extensions1=1
[Extension.1]
Type=30
NmidPropset={00020D0C-0000-0000-C000-000000000046}
NmidInteger=1
Value=1000000000000000
;**********END CFG

 

1. Go into Tools | Options | Other | Advanced Options | Custom Forms | Manage Forms
2. Hit the Install button, and choose SCL.CFG …install into your Personal Forms Library
3. Hit OK several times to return to the main Outlook screen
4. Right-click on the Column headings in your Inbox (other any other folder) and choose "Field Chooser"
5. Pull-down the scroll-bar and choose "Forms…"
6. Set focus to your Personal Forms, choose the SCL Extension Form, then click Add
7. Drag and drop the SCL property into your column headings …and voila!

- James Webster

38 Comments
Not applicable
Good, but not great.

Any way to get the X-SCL: in the headers just like messages that are written to the archive?
Not applicable
When saving the cfg file make sure yousave it to the same location as the ico files:

LargeIcon=IPML.ico
SmallIcon=IPMS.ico

This is usually Program Files<Office folder>Office 11Forms<language ID>
Not applicable
Dillon - This isn't easy to do without writing a transport sink that runs after IMF has stamped the SCL property. In addition, adding the value to the message headers has the potential for information disclosure if the message bounces back to the source of the UCE.

Colin - Thanks for pointing that out. I lost that key piece of information while cutting/pasting information from Paul.
Not applicable
Both, config file and archive manager, are top needed tools and works nicely. Thanks for those..

But is there any way to get this SCL "gateway value" to be avalaible in OWA?
Not applicable
ML - I know this is possible, but I'm not sure about the details. I'll dig around and see if I can find out some information as this is something I'd like to see on my server as well.
Not applicable
This is perfect, and helps me figure out what the levels should be. I'm looking for a way to easily give this to all my power users, so I can get an idea of what level is good. If you can, a KB article containing this would be VERY useful. And even better if there was a link from the IMF page...

Thanks
Not applicable
I have just finished installing the SCL to see the different levels. It works fine when directly connected to the exchange server, but does not work outside using Outlook2003 in a pop3 config. Is this possible? Regardless this will be very helpful.

Thanks,

Tim
Not applicable
Tim: What does "outside" mean in this case? A POP server that's not running Exchange w/the IMF?
Not applicable
Great, now spammers are able to abuse this value in the same way websites abuse the google page rank to get their sites listed more prominently. Being able to manipulate their mails and "score" them with ease will allow them to reduce the number of default outlook spam configurations that they trigger.
Not applicable
James,

Having an issue with Outlook on step 6 of your howto. The form shows up under personal forms on the left but won't move over with the add button. Any suggestions?
Not applicable
Tim -

SCL is only exposed via Mapi (Outlook Exchange mode) and via OWA (Outlook Web Access). There isn't a method to expose the property via POP/IMAP.

Andrew - SCL is only propagated between servers using xexch50 which requires an authenticated connection with SendAs permissions. As for using IMF to test their own spam and change it to get a lower score, they can do that with any bayesian filter as long as they can get their hands on the product.

AJS - I think I ran into that once as well when I had a custom filter already select. Try modifiying the Messages view and see if that works.

Not applicable
Works like a charm! Thanks!
Not applicable
Quite interesting, I have this enabled in a frontend/backend scenario, and although I can see that the filter is working (i.e. by looking at the performance counters or when archiving the obvious spams), I can't seem to find an SCL rating in Outlook. When I apply this custom form field, it only shows me field entries of -1 (local deliveries) and empty fields, nothing else.

What can cause this?
Not applicable
Peter -

SCL is transfered from FE (IMF) servers to BE (mailbox) servers using xexch50 blob. If there are any servers between the FE and BE that don't relay the xexch50 blob (like virus wall server), then the SCL value will be lost. In such topologies, you want to run IMF on a server behind your 3rd party Virus Wall server.

James
Not applicable
James,

Thanks for the reply, I had another custom filter in from another application that caused the issue.

Another quick question for you, we have some SMTP servers setup in our internal network that sometimes send mail to the Exchange server. These messages are getting SCL levels well below the threshold set (some are 1 or 2) and the level we set is 5) but are getting filtered into junk e-mail folders. I've tried adding the entire internal network subnet into the global address list but I just saw one go into the junk. Any idea?
Not applicable
AJS -

They are probably going into Junk E-mail because of Outlook 2003 filtering rather then IMF filtering. Changing your settings on Outlook 2003 from high to low may solve your problem. If it doesn't, then you should have your internal App servers submit mail using credentials instead of anonymously. Authenticated mail automatically get an SCL of -1, and as such will bypass both IMF and Outlook 2003 rules.
Not applicable
I experienced a similar problem. Sometimes mails with a SCL level below the threshold are moved to the junk mail folder of Outlook. The mails don’t come from the internal network. The Outlook internal filter is set to off. The same happened to several mailboxes. Is this a bug of the IMF or is it a problem of this scl.cfg?
Not applicable
James,

We tried that and are actually getting messages through with no SCL at all now, however, these still don't get filtered so thats ok even though it's giving a -1 as you mentioned. In any case, I'm still getting some mail through from other sources that are less than SCL 5 and Outlook filtering is off, some of this mail is coming from other companies and I have no control over authentication methods through SMTP. Any advice would be appreciated. Thanks.
Not applicable
Michael -

scl.cfg just exposes the scl column, it doesn't move the message.

If you have FE/BE topology and messages on the BE are being moved below the threshold, then you may need to restart the store on the BE server. PSS is working on a FAQ to address this and some of the other issues.
Not applicable
I get some mails in my mailbox, that does not have a SCL level, they are just empty and the mails are from an external source.
Do you know why this happens ?

I've tried to see if I could use the SCL form together with a Outlook rule, so that I personally could move SCL 3 mails to a certain folder, but I cannot get it working, nothing happens. Is this because of the scl.cfg file, that might not support using it for a rule ?

Thanks,
Peter
Not applicable
nice - thanks for this :-)

David G
Not applicable
Hi James,

Thanks for the response.

We do not have any relay servers between the fronted/backend servers, only a firewall that does let SMTP through.

The backend Exchange 2003 server is still running on Windows 2000 though I don't think it causes the problem. Does it? According to the deplozment docs You only need to deploy IMF on the frontend server for the filtering to function.

Peter
Not applicable
Just got this sorted out.

What happened was that (thanks to extra security measures) on the backend server SMTP instance only anonymous authentication was allowed.

Turned Integrated windows back on, and SCL propagation incl. Your forms display works like charm.

Might help others, might help Peter Schmidt as well.
Not applicable
This is great, thanks. For some reason the last time I stopped and started the exchange service my IMF seems to have started acting strangely. It is not moving everything with the assigned rating to the junk email folder anymore. Anyone else have this problem?
Not applicable
Exchange 2000 has no concept of the SCL MAPI property, so when the FE 2003 server sends the xexch50 blob which contains the SCL property to the BE 2000 server, this property is lost. What confuses me is your statement that you are seeing -1 for authenticated mail. Only Exchange 2003 stores will stamp that property, so I'm not quite sure why you are seeing it. My only guess is your topology may actually look like: FE e2k3 -> RG e2k -> BE e2k3

In this case the RG server is dropping the IMF stamped property, but the BE server is stamping the authenticated property.
Not applicable
Not sure whats gone wrong, but i've done what the instructions say, and most of the messages don't have any number under the SCL column, but the ones that do, are all -1
Not applicable
The IMF release notes have been updated with both known issues and a FAQ section that covers most questions asked here. You can find the latest release notes here: http://download.microsoft.com/download/2/2/C/22CCB3FB-CE5F-4E23-810B-1A4AC5540C97/IntelligentMessage...
Not applicable
I have a front end 2003 and a backend 2003 Exchange server and I am getting blank SCL values for internet mail. Additionally, the performance counters on my front end server do not increment for IMF UCE messages scanned. I have triple checked my settings per the deployment doc with no luck. I do have SCL values of -1 for email sent within the backend Exchange server.
Not applicable
I just dont get it :(
Not applicable
I have a question. I have both the configuration file installed and the registry edit to view archived SCL ratings. I sent a test e-mail from one of my yahoo account to our corporate address to see what the SCL rating is on it. I noticed that the archive rating is a 4 and the 'outlook config file' is a 3. Anyone know why this may be. Just some additional info, I only have one server acting as an email server, no extra relays or anything.
Not applicable
Hello,

I have a mailbox on a disabled user account, which is accessible by an other user.

On that mailbox SCL is always empty, so messages are not moved to junk folder.

How could I enable SCL rating on that mailbox ?

Eric
Not applicable
How would I go about putting this form on the Exchange server and making it available to all my clients? It would be nice to enable this column in the Junk Email folder for a bunch of my power users without all the client-specific stuff if it all possible. I'm an Exchange forms neophyte, so be gentle!
Not applicable
Craig - Make sure your front end servers authenticate to your back end servers. If you have authentication disabled, then the SCL property will not be transmitted.

Brian - I have no idea what you are referring to as a 'outlook config file'.

Eric - SCL properties are not exposed per mailbox, but rather per server.

Steve - I'm not a forms guru either (just an information gatherer), but I believe you can create a script that does all the steps that are listed above.
Not applicable
Hello,

I have written an agent script which installed to a public folder (or an inbox folder) makes it possible to create a junk mail folder aswell. It has several parameters, and also allows you to tag the message subject if you want to. Here it is:


<SCRIPT RunAt=Server Language=VBScript>

'------------------------------------------------------------------------------
'
' NAME: Move spam messages
'
' FILE DESCRIPTION: Automatically move and tag incomming messages
' according to the settings below
'
' Copyright (c) Peter Suba 2004. subap@eol.hu All rights reserved.
'
' Portions:
' Copyright (c) CdoLive 1999. All rights reserved.
' Http://www.cdolive.com
' Mailto:samples@cdolive.com
'
' Copyright (c) Microsoft Corporation 1993-1997. All rights reserved.
'
'------------------------------------------------------------------------------

Option Explicit

'------------------------------------------------------------------------------
' Global Variables
'------------------------------------------------------------------------------

Dim g_bstrDebug ' Debug String

'------------------------------------------------------------------------------
' CONSTANTS
'------------------------------------------------------------------------------



' Configuration constants

Const EOL_MoveAboveSCL = 5 ' Move messages that are above this SCL
Const EOL_TagAboveSCL = 3 ' Tag messages that are above this SCL (will only work if set to lower than above set parameter!)
Const EOL_TagMoved = TRUE ' Set to true if you want to tag also message that are moved
Const EOL_TagPrefix = "**** SPAM LIKELIHOOD: %SCL%/10 **** " 'Set for tag prefix: %SCL% will be replaced by SCL value assigned to message
Const EOL_MoveToSubfolder = "Junk mail" ' Moved messages will be transfered to this folder


' MAPI property tags used in this script

Const CdoPR_SCL = &H40760003 'PT_I4 (PT_MV_I4) - reméljük stimmel


'------------------------------------------------------------------------------
' EVENT HANDLERS
'------------------------------------------------------------------------------

' DESCRIPTION: This event is fired when a new message is added to the folder
Public Sub Folder_OnMessageCreated

' Declare variables
Dim objSession ' Session
Dim objFolder ' Current folder
Dim objJunkFolder ' Junk mail folder
Dim objCurrentMsg ' Current message
Dim mSCL
Dim strPrefix
Dim objMovedMsg ' Moved message
Dim strFolderID
Dim strStoreID

' Initialize variables
Set objSession = Nothing
Set objFolder = Nothing
Set objCurrentMsg = Nothing
Set objJunkFolder = Nothing


' Clear error buffer
Err.Clear

' Get session informationen
On Error Resume Next
Set objSession = EventDetails.Session

' No errors detected ?
If Err.Number = 0 Then

' Get current message
Err.Clear
On Error Resume Next
Set objCurrentMsg = objSession.GetMessage(EventDetails.MessageID,Null)

' Error detected ?
If Err.Number <> 0 Then

' Error reading current message
Call DebugAppend("Error - Could not read message", True)
Else
mSCL = objCurrentMsg.Fields(CdoPR_SCL)
If mSCL>EOL_MoveAboveSCL Then ' Move message to subfolder
If EOL_TagMoved Then
strPrefix=Replace(EOL_TagPrefix,"%SCL%",CStr(mSCL))
objCurrentMsg.Subject = strPrefix & objCurrentMsg.Subject
objCurrentMsg.Update
End If
Set objFolder = objSession.GetFolder(objCurrentMsg.FolderID,objCurrentMsg.StoreID)
Set objJunkFolder = objFolder.Folders(EOL_MoveToSubfolder)
If Err Then 'If the folder does not yet exist then create it
Call DebugAppend("Error - get junk mail folder - creating it", True)
Set objJunkFolder = objFolder.Folders.Add(EOL_MoveToSubfolder)
Err.clear
Else
If objJunkFolder.Name <> EOL_MoveToSubfolder Then
Call DebugAppend("Error - get junk mail folder (got:<"&objJunkFolder.Name&">) - creating it", False)
Set objJunkFolder = objFolder.Folders.Add(EOL_MoveToSubfolder)
End If
End If
If objJunkFolder.Name = EOL_MoveToSubfolder Then
strFolderID = objJunkFolder.ID
strStoreID = objJunkFolder.StoreID
objCurrentMsg.MoveTo strFolderID, strStoreID
End If
Else
If mSCL>EOL_TagAboveSCL Then 'Tag message
strPrefix=Replace(EOL_TagPrefix,"%SCL%",CStr(mSCL))
objCurrentMsg.Subject = strPrefix & objCurrentMsg.Subject
objCurrentMsg.Update
End If
End If
End If
Else

' Write some logging
Call DebugAppend("Junk - Undefinied Error detected", True)
End If

' Write some logging

' Clear objects
Set objSession = Nothing
Set objFolder = Nothing
Set objCurrentMsg = Nothing
Set objJunkFolder = Nothing

' Write results to the Scripting Agent log
Script.Response = g_bstrDebug

End Sub

' DESCRIPTION: This event is fired when a message in the folder is changed
Public Sub Message_OnChange
End Sub

' DESCRIPTION: This event is fired when a message is deleted from the folder
Public Sub Folder_OnMessageDeleted
End Sub

' DESCRIPTION: This event is fired when the timer on the folder expires
Public Sub Folder_OnTimer
End Sub

'-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' PRIVATE FUNCTIONS/SUBS
'-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

'------------------------------------------------------------------------------
' Name: DebugAppend
' Area: Debug
' Desc: Simple Debugging Function
' Parm: String Text, Bool ErrorFlag
'------------------------------------------------------------------------------

Private Sub DebugAppend(bstrParm,boolErrChkFlag)
If boolErrChkFlag = True Then
If Err.Number <> 0 Then
g_bstrDebug = g_bstrDebug & bstrParm & " - " & cstr(Err.Number) & " " & Err.Description & vbCrLf
Err.Clear
End If
Else
g_bstrDebug = g_bstrDebug & bstrParm & vbCrLf
End If
End Sub

</SCRIPT>
Not applicable
When we installed Microsoft's Intelligtent Message Filter last summer, the spam identification rate was about 98%, using a spam confidence level (SCL) of 4. Now, we are at 82%. With this configuration file for Outlook, one can read the SCL...
Not applicable
Greetings!
Below I&amp;rsquo;ve pasted an edited and cleaned up copy of most of the Q&amp;amp;A from today&amp;rsquo;s...
Not applicable
Not applicable
Version history
Last update:
‎May 26 2004 02:58 PM
Updated by: