Message rejected as spam by Content Filtering

Question

Hello community,

We do have Edge Servers in place before our Exchange Servers. We noticed recently from iPhone devices that mails are being rejected with the status: Diagnostic-Code: smtp; 550 5.7.1 Message rejected as spam by Content Filtering.

I have checked on our Edge Servers and the output of the command is:

C:\Windows\system32>Get-ContentFilterConfig | Format-List Enabled
Enabled : True

What it is strange is the fact that: When a user which is using apple IOS devices is sending a pdf from his/her device using Gmail mail toward our corporate mail the mail is being rejected with 550 5.7.1
• If the user is opening a new mail on Apple devices, and attaching the doc into the mail, the mail is received
• If the user is trying to share a pdf/doc from his/her apple device using GMAIL app and then removing the attachment again the mail is being rejected with 550 5.7.1
So, it seems like iphone+gmail are adding some extra layers. What has changed ? We do not want to disabled Content Filtering.

P.S: We have also noticed but a small nr of cases that the problem is even with Android Phones.

Thank You

Answer 1

Hi @Ornaldo ,

Let's go with some questions that may help us locating the root cause.

1. What's the Exchange version, is it a on-prem server or online.
2. Only this user has the issue? What about the others?
3. Have you tried with Exchange accounts or Outlook(and other) accounts? Will they pass the anti-spam check?
4. Do you mean when attaching the Doc files it could send correctly but no for the PDF? Sorry I don't know the difference between 'attaching' and 'share', or it is the difference of pdf & doc files? How about the size, is the pdf too large?

You can use the following cmdlet to check the settings of the Content Filter:

Get-ContentFilterConfig  

Please check the SCLRejectThreshold level and you could set it to a high level to allow low priority messages translating.

Also you could share the full NDR with me, or you can also compare the message header if you think the Gmail changed something.

Best regards,
Lou

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello, unfortunately I do not have the NDR

So, by ”sharing “I mean: on iPHONE > Go to Files > open pdf > select share option > select GMAIL APP > send

By “attaching” I mean: on iPHONE > open GMAIL APP > click attach doc > select the same pdf > send

Yesterday, I added into EDGE Transporter Server baypassed domain gmail and It worked but maybe it can be risky to baypass the domain *.gmail.com

I also think there is smth with the threshold:

SCLRejectThreshold: 7
SCLRejectEnabled: True

Answer 3

Hello, has anyone any idea ? Thank You

Answer 4

Hi @Ornaldo ,

Thanks for the sharing the information and all the tests and efforts you did.
I've done some researches and trying to find if there are any Official Microsoft Learn or articles about this issue( the "share" button is not available for gmail and yahoo accounts to send files), but no luck.

And I gonna ask these questions to make it clearer:

1. As you said, after add the bypass domain, you could send the files. Is this for both attach and share? If this could solve this, consider it as the backup plan.
2. Also you said the pdf, word, excel could not be transferred by "sharing", what about others, .txt, .exe.....? I think it should be a disable for the share function but if it's only block the pdf, word and excel, I could only say it's weird.
3. Have you tried to remove the edge subscription and test? If you could, please give it a try, that would help us.
4. Will this issue happen for all gmail & yahoo accounts, while not happening on outlook or Exchange accounts?

Also please let me know the Exchange server version you're using.

Thank you for your patience, we need to know is it an issue about the Exchange or the apps and then make sure that it's a server wide problem or only a number of users. Then we gonna find if this is related with the edge server or something else.

I read the update docs of April 13, 2021(KB5001779), and I don't think this is the reason:(

Best regards,
Lou

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

Hello,

1- If we bypass the domain on Edge we can receive the mail. Yes, it is a backup plan but by baypassing @Stuff .com; @réalisations .com domain we are risking to bypass even spam mails
2- I cannot test .exe since gmail it self is blocking those kind of extensions. But I have checked on Edge using the command to see what type of file extensions are blocked and .pdf; .word are not blocked.
3- Please can you explain what is “ edge subscription” ?
4- Yes, this is a problem ( noted so far ) for @Stuff , @réalisations but even for @protonmail ( sometimes )

Note: Till now by monitoring, I have noticed only false positive (pdf, word, excel files) blocked from Anti Spam at Edge level. We are considering the fact to disabled it completely since I believe it is not working as expected.

Thank You