Best set up in Exchange Admin to prevent specific emails going to junk email

%3CLINGO-SUB%20id%3D%22lingo-sub-824090%22%20slang%3D%22en-US%22%3EBest%20set%20up%20in%20Exchange%20Admin%20to%20prevent%20specific%20emails%20going%20to%20junk%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-824090%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3CBR%20%2F%3EWhat%20is%20the%20best%20set%20up%20in%20Exchange%20Admin%20to%20prevent%20specific%20emails%20going%20to%20junk%20email%3F%3CBR%20%2F%3EIs%20it%20possible%20to%20create%20a%20rule%20to%20not%20be%20filtered%20to%20junk%20email%20if%20message%20matches%20last%20part%20of%20%22Message%20ID%22%20the%20%40%3CA%20href%3D%22http%3A%2F%2Fwww.mywebsite.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ewww.mywebsite.com%3C%2FA%3E%3F%3CBR%20%2F%3EUsing%20message%20trace%20the%20%22From%20IP%22%20seems%20to%20change%20so%20not%20sure%20that%20IP%20criteria%20is%20suitable%3F%3CBR%20%2F%3EIt%20is%20a%20website%20contact%20form%20I%20want%20to%20allow.%3CBR%20%2F%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-824090%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-824887%22%20slang%3D%22en-US%22%3ERe%3A%20Best%20set%20up%20in%20Exchange%20Admin%20to%20prevent%20specific%20emails%20going%20to%20junk%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-824887%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20are%20several%20ways%20to%20do%20this%2C%20but%20first%20it's%20best%20to%20determine%20why%20those%20messages%20end%20up%20in%20spam%20so%20follow%20the%20instructions%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fprevent-email-from-being-marked-as-spam%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fprevent-email-from-being-marked-as-spam%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBased%20on%20your%20findings%20and%20the%20recommendations%20in%20the%20above%20article%2C%20you%20can%20whitelist%20the%20sender%20by%20domain%20or%20IP%20address%2Frange%20via%20the%20EOP%20policy%20settings%2C%20or%20configure%20a%20transport%20rule%20that%20sets%20the%20SCL%20to%20-1%20for%20messages%20from%20that%20sender%2C%20or%20advise%20users%20to%20add%20it%20to%20their%20safe%20senders%20list%2C%20etc.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-826029%22%20slang%3D%22en-US%22%3ERe%3A%20Best%20set%20up%20in%20Exchange%20Admin%20to%20prevent%20specific%20emails%20going%20to%20junk%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-826029%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3Bwith%20the%20help%20you%20gave%20in%20my%20other%20post%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FExchange%2FWebsite-contact-form-going-to-junk-email-and-how-to-find-reason%2Fm-p%2F816820%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FExchange%2FWebsite-contact-form-going-to-junk-email-and-how-to-find-reason%2Fm-p%2F816820%3C%2FA%3EI%20was%20able%20to%20see%20an%20issue%20with%20SPF%2C%20but%20in%20the%20headers%20I%20dont%20see%20%22X-Forefront-Antispam-Report%22%20to%20check%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fprevent-email-from-being-marked-as-spam%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fprevent-email-from-being-marked-as-spam%3C%2FA%3Eonly%20these%202%20are%20in%20the%20headers%20%22X-Microsoft-Antispam-Mailbox-Delivery%22%20and%20%22X-Microsoft-Antispam-Message-Info%22%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-827052%22%20slang%3D%22en-US%22%3ERe%3A%20Best%20set%20up%20in%20Exchange%20Admin%20to%20prevent%20specific%20emails%20going%20to%20junk%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-827052%22%20slang%3D%22en-US%22%3E%3CP%3ESPF%20is%20a%20good%20starting%20point%2C%20have%20you%20made%20sure%20that%20you've%20added%20the%20IP%20ranges%20to%20your%20SPF%20record%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-828686%22%20slang%3D%22en-US%22%3ERe%3A%20Best%20set%20up%20in%20Exchange%20Admin%20to%20prevent%20specific%20emails%20going%20to%20junk%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-828686%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20the%20IP%20for%20the%20web%20host%20server%20in%20my%20SPF%20record%20but%20according%20to%20message%20trace%20this%20is%20not%20the%20%22From%20IP%22%20%3F%3CBR%20%2F%3EMessage%20trace%20%22From%20IP%22%20seems%20to%20change%20and%20I%20have%20seen%20two%20class%20C%20networks%20so%20far%20which%20are%20not%20part%20of%20my%20web%20host%20server%20range.%3C%2FP%3E%3CP%3EIs%20it%20possible%20to%20set%20a%20rule%20based%20on%20the%20%22Message-ID%22%20header%20like%20%22%40%3CA%20href%3D%22http%3A%2F%2Fwww.mywebsite.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ewww.mywebsite.com%3C%2FA%3E%22%20or%20the%20%22From%3A%22%20header%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-829289%22%20slang%3D%22en-US%22%3ERe%3A%20Best%20set%20up%20in%20Exchange%20Admin%20to%20prevent%20specific%20emails%20going%20to%20junk%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-829289%22%20slang%3D%22en-US%22%3E%3CP%3ERules%20give%20you%20a%20lot%20of%20flexibility%2C%20but%20I%20would%20suggest%20fixing%20that%20SPF%20issue%20first.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-834087%22%20slang%3D%22en-US%22%3ERe%3A%20Best%20set%20up%20in%20Exchange%20Admin%20to%20prevent%20specific%20emails%20going%20to%20junk%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-834087%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFrom%20previous%20Microsoft%20help%20advice%20I%20have%20tried%20adding%20the%20IPs%20to%20the%20default%20connection%20filter%20but%20never%20had%20any%20luck%3F%3CBR%20%2F%3EThis%20is%20what%20my%20SPF%20record%20looks%20like%20%3CFONT%20color%3D%22%230000FF%22%3Ev%3Dspf1%20%2Ba%20%2Bmx%20%2Bip4%3A%22IP%20of%20shared%20web%20host%20server%22%20%2Binclude%3Aspf.hostedmail.net.au%20include%3Aspf.protection.outlook.com%20-all%3C%2FFONT%3E%3CBR%20%2F%3EIf%20I%20go%20the%20header%20rule%20way%20could%20I%20set%20up%20multiple%20criteria%20based%20on%20%22Received%22%2C%20%22From%22%2C%20%22Message-ID%22%20and%20am%20I%20correct%20with%20using%20%22A%20message%20header%20includes%20any%20of%20these%20words%22%20(or%20is%20it%20a%20pattern%3F)%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hi
What is the best set up in Exchange Admin to prevent specific emails going to junk email?
Is it possible to create a rule to not be filtered to junk email if message matches last part of "Message ID" the @www.mywebsite.com ?
Using message trace the "From IP" seems to change so not sure that IP criteria is suitable?
It is a website contact form I want to allow.
Thanks

6 Replies
Highlighted

There are several ways to do this, but first it's best to determine why those messages end up in spam so follow the instructions here: https://docs.microsoft.com/en-us/office365/securitycompliance/prevent-email-from-being-marked-as-spa...

 

Based on your findings and the recommendations in the above article, you can whitelist the sender by domain or IP address/range via the EOP policy settings, or configure a transport rule that sets the SCL to -1 for messages from that sender, or advise users to add it to their safe senders list, etc.

Highlighted

@Vasil Michev with the help you gave in my other post https://techcommunity.microsoft.com/t5/Exchange/Website-contact-form-going-to-junk-email-and-how-to-... I was able to see an issue with SPF, but in the headers I dont see "X-Forefront-Antispam-Report" to check https://docs.microsoft.com/en-us/office365/securitycompliance/prevent-email-from-being-marked-as-spa... only these 2 are in the headers "X-Microsoft-Antispam-Mailbox-Delivery" and "X-Microsoft-Antispam-Message-Info"

Highlighted

SPF is a good starting point, have you made sure that you've added the IP ranges to your SPF record?

Highlighted

@Vasil Michev 

I have the IP for the web host server in my SPF record but according to message trace this is not the "From IP" ?
Message trace "From IP" seems to change and I have seen two class C networks so far which are not part of my web host server range.

Is it possible to set a rule based on the "Message-ID" header like "@www.mywebsite.com" or the "From:" header?

Highlighted

Rules give you a lot of flexibility, but I would suggest fixing that SPF issue first.

Highlighted

Hi @Vasil Michev 

From previous Microsoft help advice I have tried adding the IPs to the default connection filter but never had any luck?
This is what my SPF record looks like v=spf1 +a +mx +ip4:"IP of shared web host server" +include:spf.hostedmail.net.au include:spf.protection.outlook.com -all
If I go the header rule way could I set up multiple criteria based on "Received", "From", "Message-ID" and am I correct with using "A message header includes any of these words" (or is it a pattern?)

Thanks