cannot send emails using exchange 2010 if certain words are part of message

SBS2011 is running exchange 2010
If a user tries to send an email and the message contains certain words i.e. 'bugger'
The email is not received by intended recipient.
If the word is removed from the message it goes out fine.
I have checked hub transport rules under anti-spam section of Exchange Management Console and tried switching off recipient filtering, sender filtering, sender id and sender reputation but this did not help.
Note: content filtering under hub transport is disabled
We are using a mail filtering service (mailguard) but only for inbound
What changes can I make to reduce the threshold on what ever is blocking the mail going out?
How can I add specific words so they are allowed to form part of future emails?
stevenvelIT ConsultantAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Sajid Shaik MSr. System AdminCommented:
check this link

did u disable content filtering on exchange as well on outlook spam filters ? if any..

about the content filtering how to .. please check this link

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/SBS_Small_Business_Server/Q_27996035.html

all the best
0
Asif BacchusI.T. ConsultantCommented:
Before answering, I would note one thing:  I don't know what kind of words you are referring to, but words such as 'bugger' might very well be blocked by the recipient's SPAM filter (it would be scored against on mine, for example).  Therefore, this could have nothing to do with your server at all but maybe you are just using very 'spammy' words in your messages and it's triggering a response on the receiving server.

Assuming this is not the case... The issue you are experiencing is, obviously, NOT default behaviour.  Therefore, something is specifically either set on your server or an upstream server.  A few questions:

1)   Are you relaying to a smarthost/ISP or is your server handling mail directly?
2)   Are there any other Mail Transport Agents on your system or only Exchange?
3)   Do you have any transport rules that check outgoing mail set in Exchange?

Finally, you say that certain words cause the message to not be delivered to the intended recipient.  Are they being delivered to another recipient or just outright failing to send?  Do you get an NDR or any error message at all?
0
stevenvelIT ConsultantAuthor Commented:
Thank you for your comments

It seems clear that the words are 'spammy' - i.e. bugger

Content filtering has been disabled for long time and I am not sure where else I can add an exception for specific words

1) We are not relaying to a smarthost/isp - we are handling mail directly
(MAILGUARD filters only incoming mail)

2) There are no other Mail Transport Agents - only exchange

3) No Transport rules are used

Messages are failing regardless of which recipient we send to

Yes we get an NDR:
A policy violated content was detected and removed from the original mail header, subject, body or attachment . You can safely save or delete this replacement attachment.
This is the same response from webmail and outlook - even though we select No Automatic Filtering in both
0
Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

Asif BacchusI.T. ConsultantCommented:
And you're certain that NDR is coming from YOUR exchange server and it's not just reporting that from the recipient server?
0
stevenvelIT ConsultantAuthor Commented:
I am not sure where the NDR is coming from?
0
Asif BacchusI.T. ConsultantCommented:
Hmmm... can you post the NDR here along with the header, if possible?
0
stevenvelIT ConsultantAuthor Commented:
For privacy I cannot send header.

Just to clarify:
I have tested sending 'spammy' e-mail using OWA and every now an then (not always) the recipient receives the message:
A policy violated content was detected and removed from the original mail header, subject, body or attachment . You can safely save or delete this replacement attachment.
The OWA client does not receive the message.

Another example is when an iPad user sends a 'spammy' e-mail he also gets the same message.

It seems very random.

One thing is for sure, e-mails with 'spammy' words fail to reach their intended destination even with content filtering switched off.
0
Asif BacchusI.T. ConsultantCommented:
Yes, this is why I am asking if you are sure it is YOUR server that is rejecting the message.  The NDR you are receiving sounds like one issued by a receiving server.  I understand you don't want to post the header for privacy, but even if you blanked out all IPs and just left server names, that would be helpful.

Are your messages failing with all recipients or just some or one?

In any case, let's proceed with a few simple tests...

1)   Please email YOURSELF (i.e. your email address is both the sender and recipient) a message with 'spammy' text.  This will test local delivery and isolate whether it's your server or not.  If this delivers properly, then we know locally nothing is being blocked.  This does not rule out 'external' processing, so...
2)   Next, send yourself (at an external address) an email message that is 'spammy'.  For example, email your personal gmail account or hotmail, or yahoo, etc.  If these messages are delivered then we can reasonably conclude your server is not filtering outgoing mail.

Let us know how those tests go and we'll proceed from there :-)
0
stevenvelIT ConsultantAuthor Commented:
I can confirm that 'spammy' e-mail is blocked at our server - by sending an e-mail to myself containing a suspect word and it fails as with external e-mails.
It appears our server is filtering outgoing mail but I don't know where to check?
0
Asif BacchusI.T. ConsultantCommented:
Ok, at least we've isolated the problem to your server, so we can work with it now.  This message, as far as I know, is NOT part of Exchange.  Are you by any chance using Trend Micro anti-virus/anti-spam?  If so, is it checking outgoing mail?  This message sounds like one of the warning messages generated specifically by their AV program.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
stevenvelIT ConsultantAuthor Commented:
Yes, using Trend Micro Worry Free Business Security Advanced.
I have an issue managing the filter settings because the exchange icon is missing from my Worry Free Console
I am just upgrading to latest version and I will let you know the outcome.
I am 99.99% certain its Trend Micro that is blocking Spammy e-mails
0
stevenvelIT ConsultantAuthor Commented:
Trend Micro Messaging Security Client installation had an issue so I could not find the option for content filtering.
Once I un-installed and re-installed it the content filtering was switched off and problem was resolved.

Thank you for your help!
0
Asif BacchusI.T. ConsultantCommented:
Glad you were able to get both problems resolved.  Cheers.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.