Exchange 2013 Spam Filtering does not seem to be working

Posted on 2014-04-07
Last Modified: 2014-04-09
We have just recently migrated from Exchange 2010 to Exchange 2013 and when we made the switch we immediately started receiving a ton of spam.  I have run the antispm install script and have verified that all of our settings (blacklists, whitelists, etc.) were transfered over. From what I can tell, everything is setup properly on the new server, but we are getting much more spam. How can I tell that everything anti-spam is working properly on the Exchange 2013 server?

If I run Get-TransportAgent I receive the following:
Identity                                           Enabled         Priority
--------                                           -------         --------
Transport Rule Agent                               True            1
Malware Agent                                      True            2
Text Messaging Routing Agent                       True            3
Text Messaging Delivery Agent                      True            4
Content Filter Agent                               True            5
Sender Id Agent                                    True            6
Sender Filter Agent                                True            7
Recipient Filter Agent                             True            8
Protocol Analysis Agent                            True            9
Question by:OAC Technology
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39983940
If you use perfmon you can see how many messages were scanned by each option - for the content filter agent it will also show you what the count of each SCL value is.

Start there first, see if the values are above zero or not (they are reset by restarting the transport service).


Author Comment

by:OAC Technology
ID: 39984128
It looks like Performance Monitor is showing that messages are being scanned. As far as I can tell everything is set as it should be but we are getting spam email after spam email.
LVL 17

Expert Comment

by:Brad Bouchard
ID: 39984200
I'd check your SCL levels.  See here:

You can adjust them a little at a time until you find the sweet spot.
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.


Author Comment

by:OAC Technology
ID: 39984212
I just realized that Connection Filtering isn't installed on Exchange 2013. When I run Enable-TransportAgent "Connection Filtering Agent"
I get the response "Transport agent "Connection Filtering Agent" isn't found. This means my RBL's and reverse DNS aren't looking, correct? Is there a way to enable this?
LVL 17

Accepted Solution

Brad Bouchard earned 500 total points
ID: 39984267

Author Comment

by:OAC Technology
ID: 39984277
Thanks. I was able to get this installed, but there is a 3 or 4 minute delay on incoming emails. Although if it is working properly and we don't get any more spam, it is worth the delay. I'll post back tomorrow if this did not solve the problem. Thanks for your help!
LVL 17

Expert Comment

by:Brad Bouchard
ID: 39984445
The delay will most likely go away.  Let me know how it goes.

Author Comment

by:OAC Technology
ID: 39988771
The delay is still there, but spam has drastically decreased now. Thank you for your help on this

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The new Gmail Phishing Scam going around is surprising even the savviest of users with its sophisticated techniques.
Sometimes clients can lose connectivity with the Lotus Notes Domino Server, but there's not always an obvious answer as to why it happens.   Read this article to follow one of the first experiences I had with Lotus Notes on a client's machine, my…
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question