Spam on a Distribution List

%3CLINGO-SUB%20id%3D%22lingo-sub-316157%22%20slang%3D%22en-US%22%3ESpam%20on%20a%20Distribution%20List%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-316157%22%20slang%3D%22en-US%22%3E%3CP%3EOdd%20question%20but%20we%20have%20a%20DL%20that%20is%20receiving%20a%20lot%20of%20spam.%20So%20I%20did%20a%20message%20trace%20and%20I%20noticed%20the%20attached.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20if%20i'm%20reading%20it%20right%2C%20it%20was%20marked%20as%20spam%20and%20sent%20to%20the%20junk%20folder%20but%20because%20its%20a%20DL%20email%20it%20was%20dropped%20into%20the%20inbox%3F%20Or%20am%20I%20reading%20it%20incorrect%3F%20How%20do%20I%20prevent%20spam%20mails%20from%20hitting%20a%20DL.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-316157%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESpam%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-317459%22%20slang%3D%22en-US%22%3ERe%3A%20Spam%20on%20a%20Distribution%20List%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-317459%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20%22Drop%22%20message%20is%20normal%2C%20it's%20doing%20the%20expansion%20of%20the%20DL%20members%20as%20expected.%20On%20its%20own%2C%20this%20should%20not%20cause%20the%20message%20to%20be%20delivered%20to%20the%20Inbox%2C%20so%20check%20for%20other%20related%20events%20and%20the%20message%20headers.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-316611%22%20slang%3D%22en-US%22%3ERe%3A%20Spam%20on%20a%20Distribution%20List%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-316611%22%20slang%3D%22en-US%22%3EHi%20Gary%3CBR%20%2F%3E%3CBR%20%2F%3EAs%20far%20as%20I%20know%20that%20means%20the%20spam%20went%20to%20all%20users%20in%20the%20DL%20and%20then%20was%20junked.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%20-%20am%20I%20right%20by%20saying%20this%3F%20Just%20want%20to%20get%20your%20thoughts.%3CBR%20%2F%3E%3CBR%20%2F%3EThere%20are%20several%20ways%20to%20help%20with%20spam%3CBR%20%2F%3E%3CBR%20%2F%3E1.)%20Use%20SPF%2C%20DKIM%20and%20DMARC%20on%20the%20domain%3CBR%20%2F%3E2.)%20Use%20blacklists%20for%20email%20addresses%2C%20domains%20and%20IP%E2%80%99s%3CBR%20%2F%3E3.)%20Use%20rules%20to%20fblock%20specific%20words%20and%20phrases%20found%20in%20the%20spam%20emails%3CBR%20%2F%3E4.)%20Report%20Spam%3CBR%20%2F%3E5.)%20Use%20anti%20phishing%20protection%20policies%3CBR%20%2F%3E6.)%20Use%20spam%20filter%20policies%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20following%20article%20will%20also%20give%20you%20some%20suggestions%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Freduce-spam-email%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Freduce-spam-email%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EHope%20that%20helps%20and%20answers%20your%20question.%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%20Chris%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Odd question but we have a DL that is receiving a lot of spam. So I did a message trace and I noticed the attached.

 

So if i'm reading it right, it was marked as spam and sent to the junk folder but because its a DL email it was dropped into the inbox? Or am I reading it incorrect? How do I prevent spam mails from hitting a DL.

 

 

2 Replies
Highlighted
Hi Gary

As far as I know that means the spam went to all users in the DL and then was junked.

@Vasil Michev - am I right by saying this? Just want to get your thoughts.

There are several ways to help with spam

1.) Use SPF, DKIM and DMARC on the domain
2.) Use blacklists for email addresses, domains and IP’s
3.) Use rules to fblock specific words and phrases found in the spam emails
4.) Report Spam
5.) Use anti phishing protection policies
6.) Use spam filter policies

The following article will also give you some suggestions

https://docs.microsoft.com/en-us/office365/securitycompliance/reduce-spam-email

Hope that helps and answers your question.

Best, Chris
Highlighted

The "Drop" message is normal, it's doing the expansion of the DL members as expected. On its own, this should not cause the message to be delivered to the Inbox, so check for other related events and the message headers.