Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a reasonably vanilla Exchange 2007 SP2 setup (Server Std. 2008) with a fairly liberal spam policy. I allow anything through with an SCL of 7 or lower and quarantine everything else. This lets some spam spam through but almost guarantees no false positives. (almost).

We have customers that manage their own lists that include our staff as recipients. It appears that a single delivery, addressed To:, but enveloped to three recipients at got an SCL of 8, even though it picked up an active SPF pass on the way. It was particularly infuriating as it was quite an important message, timing-wise and previous messages to the same list had been passed with no trouble. The agent log only shows the following:

[snip sender]  Content Filter Agent,OnEndOfData,QuarantineMessage,550 5.2.1 Content Filter agent quarantined this message,SclAtOrAboveQuarantineThreshold,8,DV:3.3.9515.631;SV:3.3.9007.60;SID:SenderIDStatus Pass

Now, I can whitelist some more domains and senders, but I hate having to pile up these explicit lists and I hate being beholden to black box systems that appear to arbitrarily break their own rules on a whim.

Could anyone tell me how I can see why it got an SCL of 8 (perhaps similar to what SpamAssassin would show), and whether it's possible to modify the weighting at all?


share|improve this question
up vote 1 down vote accepted

The spam confidence level rating (SCL) may be set by any installed content filter extension, but the feature you probably mean is the Exchange Intelligent Message Filter is a black box - it changes with the definition updates issued by Microsoft every month. You might define additional "blacklisted" or "whitelisted" keyword lists and recipients, but aside from that, it is not configurable in the sense as SpamAssassin is. This is the reason why many Exchange administrators do use different message filtering techniques instead.

share|improve this answer
Figures. We use Forefront, too and the IMF does a reasonable job, it just has these occasional fits... – SmallClanger May 16 '11 at 8:51
The TMG does its own content filtering on email traffic if configured accordingly: It does not have significantly more configuration options, though. BTW: in my experience, the IMF performs rather badly compared to even an out-of-the-box Amavis/Spamassassin installation. For Windows the Perl-based ASSP could be used as well, although I found it rather tiresome to configure and the daemon did hang occasionally in test installations. – the-wabbit May 16 '11 at 9:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.