Pročitaj na engleskom

Dijelite putem

Configure EOP to deliver spam to Junk Email folders in hybrid environments

  • Članak

Važno

This article is only for EOP customers in hybrid environments with mailboxes in on-premises Exchange environments. This article does not apply to Microsoft 365 customers with Exchange Online mailboxes.

If you're an Exchange Online Protection (EOP) customer in a hybrid environment, you need to configure your on-premises Exchange organization to recognize and translate the spam filtering verdicts of EOP. This configuration allows the junk email rule in on-premises mailboxes to correctly move spam from the Inbox to the Junk Email folder.

Specifically, you need to create mail flow rules (also known as transport rules) in your on-premises Exchange organization with the following settings:

  • Conditions: Find messages with the following EOP anti-spam headers and values:

    • X-Forefront-Antispam-Report: SFV:SPM (message marked as spam by spam filtering)
    • X-Forefront-Antispam-Report: SFV:SKS (message marked as spam by mail flow rules in EOP before spam filtering)
    • X-Forefront-Antispam-Report: SFV:SKB (message marked as spam by spam filtering due to the sender's email address or email domain being in the blocked sender list or the blocked domain list in EOP)

    For more information about these header values, see Anti-spam message headers.

  • Action: Set the spam confidence level (SCL) of these messages to 6 (spam).

This article describes how to create the required mail flow rules the Exchange admin center (EAC) and in the Exchange Management Shell (Exchange PowerShell) in the on-premises Exchange organization.

Savjet

Instead of delivering the messages to the on-premises user's Junk Email folder, you can configure anti-spam policies in EOP to quarantine spam messages in EOP. For more information, see Configure anti-spam policies in EOP.

What do you need to know before you begin?

Use the EAC to create mail flow rules that set the SCL of EOP spam messages

  1. In the EAC, go to Mail flow > Rules.

  2. On the Rules page, select Add > Create a new rule in the dropdown list.

  3. In the New rule page that opens, configure the following settings:

    • Name: Enter a unique, descriptive name for the rule. For example:

      • EOP SFV:SPM to SCL 6
      • EOP SFV:SKS to SCL 6
      • EOP SFV:SKB to SCL 6

    • Select More Options.

    • Apply this rule if: Select A message header > includes any of these words.

      In the Enter text header includes Enter words sentence that appears, do the following steps:

      • Select the Enter text link. In the Specify header name dialog that opens, enter X-Forefront-Antispam-Report and then select OK.
      • Select the Enter words link. In the Specify words or phrases dialog that opens, enter one of the EOP spam header values (SFV:SPM, SFV:SKS, or SFV:SKB), select Add Add icon., and then select OK.

    • Do the following: Select Modify the message properties > Set the spam confidence level (SCL).

      In the Specify SCL dialog that opens, select 6 (the default value is 5).

    When you're finished on the New rule page, select Save.

Repeat these steps for the remaining EOP spam verdict values (SFV:SPM, SFV:SKS, or SFV:SKB).

Use the Exchange Management Shell to create mail flow rules that set the SCL of EOP spam messages

Use the following syntax to create the three mail flow rules:

PowerShell 
New-TransportRule -Name "<RuleName>" -HeaderContainsMessageHeader "X-Forefront-Antispam-Report" -HeaderContainsWords "<EOPSpamFilteringVerdict>" -SetSCL 6

For example:

PowerShell 
New-TransportRule -Name "EOP SFV:SPM to SCL 6" -HeaderContainsMessageHeader "X-Forefront-Antispam-Report" -HeaderContainsWords "SFV:SPM" -SetSCL 6
PowerShell 
New-TransportRule -Name "EOP SFV:SKS to SCL 6" -HeaderContainsMessageHeader "X-Forefront-Antispam-Report" -HeaderContainsWords "SFV:SKS" -SetSCL 6
PowerShell 
New-TransportRule -Name "EOP SFV:SKB to SCL 6" -HeaderContainsMessageHeader "X-Forefront-Antispam-Report" -HeaderContainsWords "SFV:SKB" -SetSCL 6

For detailed syntax and parameter information, see New-TransportRule.

How do you know this procedure worked?

To verify that you successfully configured standalone EOP to deliver spam to the Junk Email folder in hybrid environments, do any of the following steps:

  • In the EAC, go to Mail flow > Rules, select the rule, and then select Edit Edit icon. to verify the settings.

  • In the Exchange Management Shell, replace <RuleName> with the name of the mail flow rule, and run the following command to verify the settings:

    PowerShell 
    Get-TransportRule -Identity "<RuleName>" | Format-List

  • In an external email system that doesn't scan outbound messages for spam, send a Generic Test for Unsolicited Bulk Email (GTUBE) message to an affected recipient, and confirm that the message is delivered to the Junk Email folder. A GTUBE message is similar to the European Institute for Computer Antivirus Research (EICAR) text file for testing malware settings.

    To send a GTUBE message, include the following text in the body of an email message on a single line, without any spaces or line breaks:

    text 
    XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X