spam filter allow list doesn't work

Question

Hello,

I have a question about the spam filter setup.

I added "pxxxal.de" in the list of allowed domains. But I still get emails from PayPal in my Spam folder. The sender address is: ******@mxxx.pxxxal.de. The same happens for example for emails from ******@emxxx.xxxxxxxxxxxca.com. They end up in the junk folder even though I have the domain baxxxxxxxxxca.com in the allow list. These are only two examples. It happens to me with many domains.

I set this up in:

 Exchange admin center -> protection -> spam filter -> default 

I added the domains to the allow list in the default rule

Why do those emails still go in the Junk folder?

Thanks

Enrico

Answer 1

Hello Enrico,

Thanks for your private message.

From the message header, we can see the Spam Confidence Level (SCL) value is 9. With this vlaue, the message will take the action set for High Confidence Spam in your Spam Filter. And the Bulk Complaint Level (BCL) value is 7 which depents on the set threshold in Spam Filter. Both of them have a large value which is the reason why Exchange Online Protection (EOP) marks this email as spam.

In this scenario, a good choice is creating a Bypass spam filtering transport rule. Please see:

Hope the above information helpful.

Regards,

Rudy

Answer 2

Hello Enrico,

Thanks for your reply.

And the priority of transport rule is higher than that of spam filter during mail routing, and any incoming mail cannot be avoided. But there are technologies that can avoid the spam filter. I think this may be the reason.

Anyway, glad to hear it works now. 

Regards,

Rudy

Answer 3

Hello

I try out to make some transport rules.

But I don't understand then really why I can add allowed domains in the spam Filter, when this then is ignored.

Answer 4

Hello Enrico,

Have you referred to my reply? Do you need further help?

Regards,

Rudy

Answer 5

Hello Enrico,

Thanks for posting here.

From your description, I notice that all the domains you mentioned above are third level domain. Can you add the entire third level domain to the allow list to check it? Like mxxx.pxxxal.de and emxxx.xxxxxxxxxxxca.com. 

And if there is any Inbox rule casue it? Please check it on your side and let us know the result.

If the issue persits, we'd like to collect the entire message header for further analysis. For privacy concern, I have sent you a Private Message to collect it. You can open your community profile and then click View private message to access it.

Regards,

Rudy