Office 365 spam filter seems to have changed

Hi Blue Snowman,

An admin you can add the email sender's IP address to their connection filter IP Allow list by following the steps in “Use the EAC to edit the default connection filter policy” in Configure the connection filter policy.

You can also add domains or individual senders to an allow list by following the steps in Configure your spam filter policies to check this issue.

For your reference: Prevent false positive email marked as spam with a safelist or other techniques

Let me know the result so that we can further assist you.

Best regards,

Shyamal

Thank you, I am aware of that, but please see the original question. 365 has, in the last week or so, started to flag emails FROM multiple customers TO multiple internal users.

These customers had been contacted and emailed previously.  They are multiple customers, multiple addresses, multiple domains, multiple IPs.  It is not possible to manually white list every customer or every customer domain.   We can't whitelist new and unknown customers.

Also, even if I could, that is masking the new issue of this happening rather than understand and resolve the core issue - why this is now happenng. 

According to my interpretation of the header posted, there is no reason why this email was flagged as spam - nothing in the header tells me why - and all the values I highlighted are below spam detection limits.  So why was it flagged as spam.

The link you posted is well known to me, and of no use to this question

So I'm looking to find out WHY a particular email (or multiple ones) was filtered as spam - when the header suggest nothing was wrong with it.

Hi Blue Snowman,

Since the SCL value is 5, it’s an expected behavior that the message is marked as spam.

Please refer to:

https://technet.microsoft.com/en-us/library/jj200686(v=exchg.150).aspx

And as sender’s IP is on the public block list, the message has a high SCL value.

About “The anti spam settings are probably default, and the SCL is set to 7.”, this setting is for bulk emails, not for normal emails. And it’s BCL, not SCL. 1 marks the most bulk emails as spam and 9 allows the most bulk email to be delivered. You can refer to:

https://technet.microsoft.com/en-us/library/dn759623(v=exchg.150).aspx

To let the messages which has been marked as spam (SCL is 5 or higher) to be delivered to the intended recipients, you can use the action Prepend subject line with text, **** then **** the message will be delivered to the intended recipients but prepends the subject line with the text that you specify in the Prefix subject line with this text input box.

Thanks,

Franky

Thanks for that.

The email content validator, when fed with headers and content, gave a score of 0.5 "excellent".

You are also correct, the sending IP is on a RBL - but it was from a @mail.com address, so pretty much outside of anyones control, and whitelisting a sending IP is impossible as I'm sure @mail.com use multiple IPs!

The one example I have to hand is that the 365 user and external user had multiple conversations, and only the odd one gets trapped as spam, and that's usually a reply.  Signatures are the same in both.

Hence its a bit strange - and not knowing WHY is a pain.

I will get my hands on other examples tomorrow and check it out.

Hello Blue Snowman,

As per the header, SCL marked as 5 which means there is some reputation issue on the e-mail content, check if you have any e-mail signature that contains URL. Verify the domain reputation specified on the URL on the below link also verify your domain reputation on the below link

Blacklist check

I see that the connecting IP address on the header is blacklisted with an external RBL

http://www.spamsources.fabel.dk/ip/74.208.4.20

Unless the sending domain or IP is not blacklisted on Microsoft or Microsoft partner RBL, e-mail will not be marked as spam.

Microsoft partner RBL (Real Time Blacklist)

As a word around you can white list the sender IP or domain on office 365, but analyzing the e-mail content and domain reputation issue will give the permanent  fix.

There are several online tools available to check e-mail content reputation, you may try the below to check the e-mail content reputation

e-mail content validator