Exchange 2013 Edge server ContentFilterConfig whitelist

Will Lin 21 Reputation points
2020-08-11T19:15:20.287+00:00

Hi,
Our Exchange 2013 Edge server is recently update to the latest CU and it's rejecting emails from our Canon network copier. The Content Filter Agent log shows "550 5.7.1 Message rejected as spam by Content Filtering.,SclAtOrAboveRejectThreshold,8" which means the email's SCL is 8 which is above the default of 7. I think the main issue is the copier is configured the sender and the recipient with the same email address. The reason is that if the copier fails to send the scanned images email to the recipient, the recipient will know what the problem is. This means that I can't use the "-bypasssedenders" and "-bypassedsenderdomains" option from the ContentFilterConfig. I don't know if I want to use the SCL level to 9 because more spams will pass through the filter. Anyone got some ideas how to address the issue. I don't see any option to whitelist the IP address from the ContentFilterConfig. Any suggestions will be greatly appreciated! Thank you!
Will

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,342 questions
0 comments
Accepted answer
  1. Andy David - MVP 141.3K Reputation points MVP
    2020-08-11T22:09:01.49+00:00

    Ok, in that case it wont work since the Edge Server is not the first server to receive the message from the canon.

    I would create a mail flow rule on the Edge Server that will set the SCL to -1 and allow these.

    Assuming that every message generated by the canon as this as part of the message ID:

    CanonD3E1D3.canoncopier.com

    New-TransportRule "Allow Messages From Canon Copier" -HeaderContainsWords "CanonD3E1D3.canoncopier.com" --HeaderContainsMessageHeader Message-ID -SetSCL -1

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 141.3K Reputation points MVP
    2020-08-11T19:23:20.427+00:00

    I would use Add-IPAllowListEntry and add the Copier IP Addresses there. Is that not working?

    Example:
    Add-IPAllowListEntry -IPRange 192.168.1.10-192.168.1.15

    More info on how to enable and add IP addresses:
    https://learn.microsoft.com/en-us/exchange/antispam-and-antimalware/antispam-protection/connection-filtering-procedures?view=exchserver-2019#ip-allow-list-procedures

    2 people found this answer helpful.
  2. Lucas Liu-MSFT 6,161 Reputation points
    2020-08-12T05:15:35.91+00:00

    Hi WillLin,
    Please run the following command to create the transport rule. This transport rule is that when the from in the header field of the email is CanonD3E1D3.canoncopier.com, the SCL value of this email is set to -1. -1 means from a trusted sender, so the message bypasses spam filtering. 

    New-TransportRule "Test1" -HeaderContainsWords "CanonD3E1D3.canoncopier.com" -HeaderContainsMessageHeader From -SetSCL -1

    For more information you could refer to: New-TransportRule and Antispam stamps

    The following is my test in the environment. Because user7 is an internal user, the default SCL value is -1, so I set the SCL value of the email from user7 is set to 3. 

    New-TransportRule "Test2" -HeaderContainsWords "user7@contoso.com" -HeaderContainsMessageHeader From -SetSCL 3

    17056-1111.png

    When I use ExRCA to analysis the mail from user7, I can see that the SCL of the mail has been successfully set to 3.
    17135-22222.png

    1 person found this answer helpful.