Link to home
Create AccountLog in
Avatar of suriyaehnop
suriyaehnopFlag for Malaysia

asked on

Unable to accept email from external

I have an issue with accepting email from one of external user, haeco.com. It not happened to all email from this domain. Some email from this domain able to reach internal user without any issue.

Our mail flow:

Symantec | Edge Server | Hub Transport | Mailbox

The NDR informed that 550 5.7.1 Message rejected as spam by Content Filtering.

After did some troubleshooting, I found out that this might be due to Edge Content Filtering settings. The settings said that "Reject email as spam if SCL greater or equal to 7"

I did checked a log at C:\Program File\Microsoft\Exchange\TransportRole\Logs\AgentLog


Please refer to screenshot. The screenshot show many result. FYI sender and recipient are same person in all result.

As you can see, the SCL keep changing although it was sent from the same sender and the sender only attached multiple excel file (checked on symantect email tracking).

It is tools available that I can use it to process the original email from sender, if there a few hidden not allow content type exist on the email since what I can see is the sender only send an excel file/pdf
Heaco-1.JPG
haeco2.JPG
Avatar of Simon Butler (Sembee)
Simon Butler (Sembee)
Flag of United Kingdom of Great Britain and Northern Ireland image

The message is being blocked by content filtering, so there is something about the content of the email that the filter doesn't like. Your only option is to whitelist that sender. It will be almost impossible to know exactly what is tripping off the filter to block the message.

Simon.
Avatar of suriyaehnop

ASKER

I also can increase the SCL level from 7 to 9 right or can I have just whitelist the sender's domain name
Avatar of gkousikan
gkousikan

If you are using Symantec messsage lab gateway, add domain to approved sender list and also check any content filter rules created in Symantec message lab.
Increasing the SCL value will increase the amount of spam that you get.
If you run perfmon and add the counters to show the SCL value that will give you an idea of the levels involved. It isn't something I would do just for a single domain/user.

Simon.
Simon,

I tracked the AgentLog on Edge server as screenshot I'm attached. I assume that the "ReasonData" mean the SCL value since it contained value from 0 to 7. The highest, I can get 7 and this email will be rejected by Edge server.

So far, I found only certain email from 2 domain addresses and it is not possible to add the sender since there are huge number of sender from these 2 domains.

So, the final solution is add the sender domain name.

Need your advice...
ASKER CERTIFIED SOLUTION
Avatar of Simon Butler (Sembee)
Simon Butler (Sembee)
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
I've requested that this question be closed as follows:

Accepted answer: 0 points for suriyaehnop's comment #a39183090

for the following reason:

thank you for the link
I have provided a number of solutions and answers to the questions and don't get any points?
My last comment #39186978 I believe answers the question as it covers how to white list the domains required. It could be said that some of my previous answers also contributed and may need to be awarded an assist.

Simon.