Configure Outlook to show the original sender in the spam quarantine mailbox

  • Article

Spam quarantine is a feature of the Content Filter agent that reduces the risk of losing legitimate messages. Spam quarantine provides a temporary storage location for messages that are identified as spam and that shouldn't be delivered to a user mailbox inside the organization. For more information, see Spam quarantine in Exchange Server.

When a message meets the spam quarantine threshold, it's wrapped in a non-delivery report (also known as an NDR, delivery status notification, DSN, or bounce message) and delivered to the spam quarantine mailbox. Because the quarantined messages are stored as NDRs, the postmaster address of your organization will be listed as the From: address for all messages. However, having the original sender address, the original recipient address, and the original spam confidence level (SCL) in the field list would make it easier to locate the message you want to recover.

By default, you can't add these fields in the message view in Microsoft Outlook. You need to create an Outlook form that adds the original sender, original recipient, and original SCL as optional fields that you can select. After you create this custom form, you can configure Outlook to display these fields in the message view.

What do you need to know before you begin?

  • Estimated time to complete this procedure: 15 minutes.

  • You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Mailbox access" entry in the Mail flow permissions topic.

  • This procedure requires that you've configured the quarantine mailbox. For more information, see Configure a spam quarantine mailbox.

  • You need to configure an Outlook profile that you use to access the spam quarantine mailbox. For more information about configuring and using multiple Outlook profiles, see Overview of Outlook e-mail profiles.

    You can use MAPI utilities (for example, OutlookSpy or MFCMAPI) to find the MAPI properties in a quarantined message that contain the original sender, recipient, and SCL values. If you find that other MAPI properties give better results than the ones identified in this topic, you can use them in the custom Outlook form.

  • For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

Tip

Having problems? Ask for help in the Exchange forums. Visit the forums at: Exchange Server, Exchange Online, or Exchange Online Protection.

Step 1: Use Notepad to create a custom Outlook form

  1. Open Notepad, and copy the following code into the document.

    [Description]
MessageClass=IPM.Note
CLSID={00020D31-0000-0000-C000-000000000046}
DisplayName=Quarantine Extension Form
Category=Standard
Subcategory=Form
Comment=This form allows the Original Sender (ReceivedRepresentingEmailAddress), Original Recipient (To), and Original SCL (OriginalScl) values to be viewed as columns.
LargeIcon=IPML.ico
SmallIcon=IPMS.ico
Version=3.0
Locale=enu
Hidden=1
Owner=Microsoft Corporation
Contact=Your Name
[Platforms]
Platform1=Win16
Platform2=NTx86
Platform9=Win95
[Platform.Win16]
CPU=ix86
OSVersion=Win3.1
[Platform.NTx86]
CPU=ix86
OSVersion=WinNT3.5
[Platform.Win95]
CPU=ix86
OSVersion=Win95
[Properties]
Property01=ReceivedRepresentingEmailAddress
Property02=DisplayTo
Property03=OriginalScl
[Property.ReceivedRepresentingEmailAddress]
Type=31
NmidInteger=0x0078
DisplayName=ReceivedRepresentingEmailAddress
[Property.DisplayTo]
Type=31
NmidInteger=0x0E04
DisplayName=DisplayTo
[Property.OriginalScl]
Type=3
NmidPropset={41F28F13-83F4-4114-A584-EEDB5A6B0BFF}
NmidString=OriginalScl
DisplayName=OriginalScl
[Verbs]
Verb1=1
[Verb.1]
DisplayName=&Open
Code=0
Flags=0
Attribs=2
[Extensions]
Extensions1=1
[Extension.1]
Type=31
NmidPropset={00020D0C-0000-0000-C000-000000000046}
NmidInteger=1
Value=1000000000000000

  2. Save the file in your Office Forms folder using the following values:

    • Path: <OfficeInstallPath>\<OfficeVersion>\Forms\<LCID>

    • <OfficeInstallPath>:

      • For 32-bit versions of Office on 32-bit versions of Microsoft Windows, or 64-bit versions of Office on 64-bit versions of Windows, the default path is C:\Program Files\Microsoft Office\root.

      • For 32-bit versions of Office on 64-bit versions of Windows, the default path is C:\Program Files (x86)\Microsoft Office\root.

    • <OfficeVersion>

      • Outlook 2010: Office14

      • Outlook 2013: Office15

      • Outlook 2016: Office16

    • <LCID>: This is your locale ID (LCID) value. For example, the LCID for US English is 1033. For more information, see Language identifiers and OptionState Id values in Office.

    • Name: For the rest of this procedure, assume the file is named QTNE.cfg. The name of the file isn't important, but be sure to save the file as QTNE.cfg and not QTNE.cfg.txt.

For example, for a 32-bit US English version of Outlook 2016 installed on a 64-bit version of Windows, save the file as:

"C:\Program Files (x86)\Microsoft Office\root\Office16\Forms\1033\QTNE.cfg"

Note

If Windows User Access Control (UAC) prevents you from saving the file in the correct location, save it first to a temporary location, and then copy it.

Step 2: Configure Outlook 2010 or later to use the custom Outlook form

  1. Open the spam quarantine mailbox in Outlook on a client computer, and click File > Options > Advanced.

  2. In the Developers section, click Custom Forms.

  3. In the Options dialog box that opens, click Manage Forms.

  4. In the Forms Manager dialog box that opens, click Install. Browse to the location of the QTNE.cfg file, select it, and click Open. In the Form Properties dialog box, review the information, and then click OK to install the Quarantine Extension Form in your Personal Forms library.

  5. Back in the Forms Manager dialog box, click Close. Click OK twice to close the remaining dialog boxes and return to the main Outlook interface.

  6. In the Mail view of the Inbox, click View > Add columns.

  7. In the Show Columns dialog box that opens, in the Select available columns from drop-down list, scroll to the end of the list and select Forms.

  8. In the Select Enterprise forms for this folder dialog box that opens, in the Selected Forms field, select Message and click Remove. In the Personal Forms field, select Quarantine Extension Form, and then click Add. When you're finished, click Close.

  9. Back in the Show Columns dialog box, in the Available Columns section, select one or more of the following fields and click Add after each field you select.

    • ReceivedRepresentingEmailAddress: Original sender

    • DisplayTo: Original recipient (note that this appears as To after you add it)

    • OriginalScl: Original SCL

      Use the Move Up or Move Down buttons to position the columns in the view. For best results, position the new fields after the Attachment field, and before the From field. When you're finished, click OK twice to return to the main Outlook interface.

How do you know this worked?

You know this procedure worked if you can see the original sender, original recipient, or original SCL values for quarantined messages in the spam quarantine mailbox using Outlook.