• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 303
  • Last Modified:

Exchange 2010 Anti-Spam - Custom Words

We've been getting an awful lot of spam, so I've been adding words to the custom words list and changing the rating for deletion down to 6. I also created a transport rule where if the SCL rating is 7+/delete message.

However, using only a specified custom word in both the subject and body - I am still able to email myself from my personal email. So it's never actually checking against the custom words list.

All of the anti spam nodes are enabled in OC>AntiSpam and SC>Hub

Any advice besides purchasing third party software?
0
RISLA
Asked:
RISLA
  • 2
1 Solution
 
Simon Butler (Sembee)ConsultantCommented:
Third party software is usually the best option if you find the built in tools aren't doing the job. Custom words I find is not very productive, plus you are wasting bandwidth because the message is delivered before you can actually scan it.

If you look at the headers of the message that gets through - does it have an SCL value?

Simon.
0
 
RISLAAuthor Commented:
I am seeing an SCL, never even thought to check...very new to Exchange.

Here is one example of spam

Received: from 006c6859.zymorn.info (173.44.212.153) by
 server.mydomain x.x.x.x) with Microsoft SMTP Server id
 x.x.x.x; Fri, 17 Oct 2014 06:11:52 -0400
Received: by 006c6859.ear60lj.zymorn.info      (amavisd-new, port 6387) with ESMTP
 id 00SWOUNG6C68MJJRED59;      for <me@domain.com>; Fri, 17 Oct 2014 03:12:32
 -0700
Date: Fri, 17 Oct 2014 03:12:32 -0700
Subject: Printer Ink-Save up to 85% off.
To: <me@domain.com>
From: Cheapprinterink <Cheapprinterink@zymorn.info>
Message-ID: <3872017104214387154143545643@ear60lj.zymorn.info>
Content-Language: en-us
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: multipart/alternative;
      boundary="----=Part.715.4235.1413540752"
Return-Path: Cheapprinterink@zymorn.info
X-MS-Exchange-Organization-AuthSource: server.domain.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: zymorn.info
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (RIJB-EX.nesla-domain.com: Cheapprinterink@zymorn.info
 does not designate permitted sender hosts)
X-MS-Exchange-Organization-SCL: 5
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.14213.475;SID:SenderIDStatus None;OrigIP:173.44.212.153

Thanks for your help with this!
0
 
Simon Butler (Sembee)ConsultantCommented:
There is your SCL value:
X-MS-Exchange-Organization-SCL: 5

If you have deletion set at 6, that message should have been deleted.

The IP address in the message is on a number of blacklists, so that would have caught it as well.

Have you configured the content filter to delete the messages at 6?
http://technet.microsoft.com/en-gb/library/aa995953(v=exchg.150).aspx

Simon.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now