Spam filtering before redirecting email

Question

Spam filtering before redirecting email

KarolisSSSSS 21

Hi, we O365 Exchange Online, we've created a shared mailbox and all incoming emails are redirected (automatically forwarded) to external email. If we receive spam email, it is redirected (forwarded) to external email and then goes to spam filter. Is it possible to set rules that first action would be going to spam filter and only if it is not a spam it is being redirected to external email address?

Itch Sun-MSFT 2,566 Reputation points

2020-10-28T07:07:48.17+00:00

Hi @KarolisSSSSS
According to your description, this question seems to be related to Exchange, so we would move the irrelevant tags.

Answer accepted by question author

1 additional answer

Your answer

Itch Sun-MSFT 2,566 Reputation points

2020-10-28T07:07:48.17+00:00

Hi @KarolisSSSSS
According to your description, this question seems to be related to Exchange, so we would move the irrelevant tags.

Answer 1

Lydia Zhou - MSFT 2,386 Microsoft Employee

@KarolisSSSSS

What about creating an Inbox rule for shared mailbox to redirect or forward messages? If so, you have to create a transport rule to prepend the subject of those inbound messages, then you can create an Inbox rule like this: "messages with specific words in the subject (add by mail flow rule), redirect/forward to another user".

For your reference: Add rules to a shared mailbox.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Lydia Zhou - MSFT 2,386 Reputation points Microsoft Employee

2020-10-27T07:22:21.193+00:00

Just checking in to see if above information was helpful. If you have any questions or need further help on this issue, please feel free to post back.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
KarolisSSSSS 21 Reputation points

2020-10-27T07:27:21.703+00:00

That's a great idea. I will test it out.
Andy David - MVP 160.2K Reputation points MVP Volunteer Moderator

2020-10-27T17:07:37.827+00:00

Note that Allowing forwarding to external recipients by rule from an Outlook mailbox is generally not recommended. If a mailbox is compromised the attacker can create rules to forward emails to outside recipient and you will never know it.
Lydia Zhou - MSFT 2,386 Reputation points Microsoft Employee

2020-10-30T07:45:08.4+00:00

Any updates so far? If you have solved your problem, could you share with us? Maybe it will help more people with similar problems.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
KarolisSSSSS 21 Reputation points

2020-11-11T23:43:31.337+00:00

I have used your method and it works great.
Lydia Zhou - MSFT 2,386 Reputation points Microsoft Employee

2020-11-12T01:15:10.737+00:00

Glad to hear that. If you have other issues about Exchange, please feel free to post with related tags.

Have a nice day.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Sultan Arif Vaseem 0 Reputation points

2024-08-30T15:44:32.99+00:00

Thanks @Lydia Zhou - MSFT . This worked also for me.

Answer 2

Andy David - MVP 160.2K MVP Volunteer Moderator

Not possible since rules fires before the anti-spam checks.

However... Anti-malware checks happen before a transport rule. Are you saying that malware messages are being forwarded as well?
If so, I would use a transport rule to forward instead of forwarding from the mailbox and see if at least those are blocked

If you want to mark specific messages as spam before they're even scanned by spam filtering, or mark messages so they'll skip spam filtering, you can create mail flow rules (also known as transport rules) to identify the messages and set the spam confidence level (SCL). For more information about the SCL, see Spam confidence level (SCL) in EOP.

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-mail-flow-rules-to-set-the-spam-confidence-level-scl-in-messages?view=o365-worldwide

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/exchange-online-protection-overview?view=o365-worldwide#how-eop-works

KarolisSSSSS 21 Reputation points

2020-10-22T16:06:03.627+00:00

Thank you for fast response.
So as I understand you advise to use these rules?
Andy David - MVP 160.2K Reputation points MVP Volunteer Moderator

2020-10-22T16:12:35.01+00:00

Well, the anti-spam checks will still not be applied. But the anti-malware will if you use transport rules. If malware messages are being redirected to the external mailbox that is worse than the SPAM! :)
KarolisSSSSS 21 Reputation points

2020-10-22T16:45:41.047+00:00

Thanks, that's a good point, 70% of all unwanted emails are malware. :) I have created transport rules instead of direct forward.
Andy David - MVP 160.2K Reputation points MVP Volunteer Moderator

2020-10-22T16:48:43.353+00:00

:)
If you could, please mark any accepted answer and we can close this up. Thanks!
swey 11 Reputation points

2022-10-17T16:10:59.257+00:00
With Exchange Rule
I don't think "Anti-malware checks happen before a transport rule" is true for exchange online, i have sent test-messages to anti-malware policies with "Enable the common attachments filter" instead of "Enable zero-hour auto purge for malware" and they still got forwarded (same policy)!

Additional it is not possible to configure a transport rule with "ExceptIfSCLOver" or "SCLOver" in exchange online, just not supported

This parameter is functional only in on-premises Exchange.
This condition is available on Mailbox servers and Edge Transport servers. This condition is not available or functional in the cloud-based service due to how the service filtering stack works.

Source:https://learn.microsoft.com/en-us/powershell/module/exchange/set-transportrule?view=exchange-ps#-exceptifsclover

Others: EXCLUDE forwarding content from the Junk folder. > https://feedbackportal.microsoft.com/feedback/idea/be48dcce-41e2-ec11-a81b-000d3a00c008

With Mailbox or SMTP Forwarding

(same as with exchange rule)

With Inbox Rule

E-Mails which are going to Junk-Folder or Quarantine are not getting forwarded (just e-mails to Inbox-Folder)

Downside: content gets edited with forwarding, use redirect

Downside: exclude for e-mail forwarding has to be enabled in outgoing defender policy

Share via

Spam filtering before redirecting email

1 additional answer

Your answer