Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an SBS 2008 box running Exchange 2007. Mail is delivered directly to the Exchange machine from the Internet via a receive connector (I have already advised people that it would be better to use a smarthost...)

I've configured Content Filtering to reject anything over an SCL of 6. Deleting and quarantining options are disabled. SCLJunkThreshold is set to 5.

There are a couple of users who are seeing mail delivered to their inboxes despite the headers clearly having the X-Ms-Exchange-Organization-Scl attribute set to a value higher than either threshold. e.g. 8

Looking at Message Tracking shows that the ReceipientStatus is "550 5.7.1 Message rejected as spam by Content Filtering." as expected. However, there is then a DELIVER event from STOREDRIVER which I assume is where the message is placed in to the mailbox.

I suppose my first question is have I misunderstood how rejection is applied? i.e. is this purely treatment of the sender by sending them a notification rather than discarding the message internally. If not, any ideas as to why Exchange is still delivering messages that are clearly spam?

Many thanks,

Mike

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.