Solved

cannot send emails using exchange 2010 if certain words are part of message

Posted on 2014-11-07
13
203 Views
Last Modified: 2014-11-18
SBS2011 is running exchange 2010
If a user tries to send an email and the message contains certain words i.e. 'bugger'
The email is not received by intended recipient.
If the word is removed from the message it goes out fine.
I have checked hub transport rules under anti-spam section of Exchange Management Console and tried switching off recipient filtering, sender filtering, sender id and sender reputation but this did not help.
Note: content filtering under hub transport is disabled
We are using a mail filtering service (mailguard) but only for inbound
What changes can I make to reduce the threshold on what ever is blocking the mail going out?
How can I add specific words so they are allowed to form part of future emails?
0
Comment
Question by:stevenvel
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 6
13 Comments
 
LVL 16

Expert Comment

by:Shaik M. Sajid
ID: 40430021
check this link

did u disable content filtering on exchange as well on outlook spam filters ? if any..

about the content filtering how to .. please check this link

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/SBS_Small_Business_Server/Q_27996035.html

all the best
0
 
LVL 6

Expert Comment

by:Asif Bacchus
ID: 40430170
Before answering, I would note one thing:  I don't know what kind of words you are referring to, but words such as 'bugger' might very well be blocked by the recipient's SPAM filter (it would be scored against on mine, for example).  Therefore, this could have nothing to do with your server at all but maybe you are just using very 'spammy' words in your messages and it's triggering a response on the receiving server.

Assuming this is not the case... The issue you are experiencing is, obviously, NOT default behaviour.  Therefore, something is specifically either set on your server or an upstream server.  A few questions:

1)   Are you relaying to a smarthost/ISP or is your server handling mail directly?
2)   Are there any other Mail Transport Agents on your system or only Exchange?
3)   Do you have any transport rules that check outgoing mail set in Exchange?

Finally, you say that certain words cause the message to not be delivered to the intended recipient.  Are they being delivered to another recipient or just outright failing to send?  Do you get an NDR or any error message at all?
0
 

Author Comment

by:stevenvel
ID: 40431008
Thank you for your comments

It seems clear that the words are 'spammy' - i.e. bugger

Content filtering has been disabled for long time and I am not sure where else I can add an exception for specific words

1) We are not relaying to a smarthost/isp - we are handling mail directly
(MAILGUARD filters only incoming mail)

2) There are no other Mail Transport Agents - only exchange

3) No Transport rules are used

Messages are failing regardless of which recipient we send to

Yes we get an NDR:
A policy violated content was detected and removed from the original mail header, subject, body or attachment . You can safely save or delete this replacement attachment.
This is the same response from webmail and outlook - even though we select No Automatic Filtering in both
0
Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

 
LVL 6

Expert Comment

by:Asif Bacchus
ID: 40431663
And you're certain that NDR is coming from YOUR exchange server and it's not just reporting that from the recipient server?
0
 

Author Comment

by:stevenvel
ID: 40431679
I am not sure where the NDR is coming from?
0
 
LVL 6

Expert Comment

by:Asif Bacchus
ID: 40432243
Hmmm... can you post the NDR here along with the header, if possible?
0
 

Author Comment

by:stevenvel
ID: 40432661
For privacy I cannot send header.

Just to clarify:
I have tested sending 'spammy' e-mail using OWA and every now an then (not always) the recipient receives the message:
A policy violated content was detected and removed from the original mail header, subject, body or attachment . You can safely save or delete this replacement attachment.
The OWA client does not receive the message.

Another example is when an iPad user sends a 'spammy' e-mail he also gets the same message.

It seems very random.

One thing is for sure, e-mails with 'spammy' words fail to reach their intended destination even with content filtering switched off.
0
 
LVL 6

Expert Comment

by:Asif Bacchus
ID: 40434021
Yes, this is why I am asking if you are sure it is YOUR server that is rejecting the message.  The NDR you are receiving sounds like one issued by a receiving server.  I understand you don't want to post the header for privacy, but even if you blanked out all IPs and just left server names, that would be helpful.

Are your messages failing with all recipients or just some or one?

In any case, let's proceed with a few simple tests...

1)   Please email YOURSELF (i.e. your email address is both the sender and recipient) a message with 'spammy' text.  This will test local delivery and isolate whether it's your server or not.  If this delivers properly, then we know locally nothing is being blocked.  This does not rule out 'external' processing, so...
2)   Next, send yourself (at an external address) an email message that is 'spammy'.  For example, email your personal gmail account or hotmail, or yahoo, etc.  If these messages are delivered then we can reasonably conclude your server is not filtering outgoing mail.

Let us know how those tests go and we'll proceed from there :-)
0
 

Author Comment

by:stevenvel
ID: 40434275
I can confirm that 'spammy' e-mail is blocked at our server - by sending an e-mail to myself containing a suspect word and it fails as with external e-mails.
It appears our server is filtering outgoing mail but I don't know where to check?
0
 
LVL 6

Accepted Solution

by:
Asif Bacchus earned 500 total points
ID: 40436067
Ok, at least we've isolated the problem to your server, so we can work with it now.  This message, as far as I know, is NOT part of Exchange.  Are you by any chance using Trend Micro anti-virus/anti-spam?  If so, is it checking outgoing mail?  This message sounds like one of the warning messages generated specifically by their AV program.
0
 

Author Comment

by:stevenvel
ID: 40443920
Yes, using Trend Micro Worry Free Business Security Advanced.
I have an issue managing the filter settings because the exchange icon is missing from my Worry Free Console
I am just upgrading to latest version and I will let you know the outcome.
I am 99.99% certain its Trend Micro that is blocking Spammy e-mails
0
 

Author Comment

by:stevenvel
ID: 40451316
Trend Micro Messaging Security Client installation had an issue so I could not find the option for content filtering.
Once I un-installed and re-installed it the content filtering was switched off and problem was resolved.

Thank you for your help!
0
 
LVL 6

Expert Comment

by:Asif Bacchus
ID: 40451665
Glad you were able to get both problems resolved.  Cheers.
0

Featured Post

The Ultimate Checklist to Optimize Your Website

Websites are getting bigger and complicated by the day. Video, images, custom fonts are all great for showcasing your product/service. But the price to pay in terms of reduced page load times and ultimately, decreased sales, can lead to some difficult decisions about what to cut.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I work for a company that primarily works with small businesses as their outsourced IT vendor. As such the majority of these customers utilize some version of Small Business Server. Due to the economics of running a small business, many of these cus…
If you are a user of the discontinued Microsoft Office Accounting 2008 (MSOA) and have to move to a new computer running Windows 8, you will be unhappy to discover that it won't install.  In particular, Microsoft SQL Server 2005 Express Edition (SSE…
This is a high-level webinar that covers the history of enterprise open source database use. It addresses both the advantages companies see in using open source database technologies, as well as the fears and reservations they might have. In this…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question