Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an SBS 2008 box running Exchange 2007. Mail is delivered directly to the Exchange machine from the Internet via a receive connector (I have already advised people that it would be better to use a smarthost...)

I've configured Content Filtering to reject anything over an SCL of 6. Deleting and quarantining options are disabled. SCLJunkThreshold is set to 5.

There are a couple of users who are seeing mail delivered to their inboxes despite the headers clearly having the X-Ms-Exchange-Organization-Scl attribute set to a value higher than either threshold. e.g. 8

Looking at Message Tracking shows that the ReceipientStatus is "550 5.7.1 Message rejected as spam by Content Filtering." as expected. However, there is then a DELIVER event from STOREDRIVER which I assume is where the message is placed in to the mailbox.

I suppose my first question is have I misunderstood how rejection is applied? i.e. is this purely treatment of the sender by sending them a notification rather than discarding the message internally. If not, any ideas as to why Exchange is still delivering messages that are clearly spam?

Many thanks,


share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.