Hello
We recently transitioned from mimecast to EOP\ATP. Since then we are noticing alot of bulk emails coming in that were previously caught by mimecast. We have enabled the default anti spam policy and set the BCL to 3. When looking at the message headers for some of these bulk emails, EOP is stamping a 0 for BLC, which means EOP thinks its legit email, but its not. The suggestion is to use transport rules to stamp a custom scl\bcl rating on the emails, but this seems like alot of overhead . Any suggestions on how to proceed with limiting the amount of BULK emails ?
