How to Test AntiSpam Policies And Trigger Quarantine Notifications

Question

How to Test AntiSpam Policies And Trigger Quarantine Notifications

Dieter Tontsch (GMail) 972

In order to test AntiSpam protection in Exchange Online I have created a AntiSpam Policy in Security Center which applies for a certain user and have set "URL to .biz or .info websites" to on.
But if I do send an email to this user with like e.g. "this is a body with https://www.mydomain.biz in it" that emails always go through. Isn't this enough, the rest of the Filter Settings are as default, basically "Bulk email spam action=6" and "Bulk email threshold=On", everything else is set to Off, except "URL to .biz or .info websites".

This URL to .biz or .info websites as the only matching criteria isn't enough to classify it as spam? Is that algorithm a bit more sophisticated? Or does just the AntiSpam policy taking a longer amount of time until it applies, I was waiting for about 30 min. so far.
Another option might be Mail Flow Rule with specific words in subject or body, but I don't see there any option to move such mails into quarantine, I can just block or delete them, which is not what I need for my tests.

And does anyone know if and how I can manually trigger the Quarantine notification settings in order to get email? I have configured this in Global settings accordingly, but I don't know if it works. I also have created Quarantine Policy with Quarantine Notification enabled and referenced a to a AntiSpam policy in Actions.
Because otherwise, if this only works automated I always have to wait at least 1 day, it's not even possible to specify the timie for such quarantine notification emails.

kind regards,
Dieter

Accepted answer

0 additional answers

Your answer

Answer 1

KyleXu-MSFT 26,396

@Anonymous

I try to create an anti-spam inbound policy in my tenant, it could work immediately：

Then send emails from Gmail:

I could find it in Quarantine:

About the "Quarantine notification", as far as I know the minimum interval is daily notification. It cannot be set to notify immediately so far.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Dieter Tontsch (GMail) 972 Reputation points

2022-04-12T09:03:40.863+00:00

Ok, basically you are right, the URL filtering on .biz works. but in my tests it works just on some senders.
First I used my private gmail address and for that one it doesn't work. Well, I thought there might be some hidden setting somewhere where this sender is considered trusted or os, because I often use this address for testings.
But it also doesn't work for another gmail address of mine, which I definitely haven't used yet in the O365 context at all.
It works for other gmail addresses (of my colleagues) , it also works for a GMX address of mine, but it again doesn't work for a very custom private domain email address.

so, in addition it works, but not reliable. and I cannot tell when it works and when not. All I can tell is that for senders it works it always works, and for those it doesn't it never does. At least during my about 20 test emails in total.

But thanks for confirming.

kind regards,
Dieter

Share via

How to Test AntiSpam Policies And Trigger Quarantine Notifications

0 additional answers

Your answer