up vote 0 down vote favorite
share [g+] share [fb]

I have a Server 2008 R2 box running Exchange 2010 and Forefront Protection 2010. I have content filtering enabled and my SCL levels set to where I want them in Forefront. I'm filtering by keyword and file extension. In testing, I sent myself purposeful spam emails from a personal gmail account containing the keywords that I am filtering for and they get through unabated.

I checked the headers on the messages and it looks like the mails are being assigned an SCL of -1? Can anyone tell me what is going on? I know -1 means it's from a trusted sender but i'm not sure how gmail's servers got to be trusted senders in the first place!

link|improve this question
Is your Gmail address in your safe senders list in Outlook? – Ben Pilbrow Jan 23 at 22:02
Or in your list of allowed sender domains in Forefront – Mathias R. Jessen Jan 23 at 22:29
It isnt on the safe senders list, no. hmmm, since im accessing my Gmail web access from inside our network, is it technically originating from my domain? – Ethan Hohensee Jan 23 at 22:31
No, a trusted sender is determined on basis of the Sender ID in the message header, it has nothing to do with the network from which you connect to your webmail. Check the Domain list in the Content Filter configuration in the Forefront console – Mathias R. Jessen Jan 23 at 22:45
There is nothing in the Allowed Sender Domains list. So nothing is explicitly allowed. The dashboard shows that 2 messages, which would be the two I sent, tripped the Transport Scanner keyword filter and created an incident. It looks like FPE knows that these emails should be filtered, but the -1 SCL is letting them though. – Ethan Hohensee Jan 23 at 22:55
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.