Configure EOP to deliver spam to Junk Email folders in hybrid environments

Important

This article is only for EOP customers in hybrid environments with mailboxes in on-premises Exchange environments. This article does not apply to Microsoft 365 customers with Exchange Online mailboxes.

If you're an Exchange Online Protection (EOP) customer in a hybrid environment, you need to configure your on-premises Exchange organization to recognize and translate the spam filtering verdicts of EOP. This configuration allows the junk email rule in on-premises mailboxes to correctly move spam from the Inbox to the Junk Email folder.

Specifically, you need to create mail flow rules (also known as transport rules) in your on-premises Exchange organization with the following settings:

• Conditions: Find messages with the following EOP anti-spam headers and values:

  • X-Forefront-Antispam-Report: SFV:SPM (message marked as spam by spam filtering)
  • X-Forefront-Antispam-Report: SFV:SKS (message marked as spam by mail flow rules in EOP before spam filtering)
  • X-Forefront-Antispam-Report: SFV:SKB (message marked as spam by spam filtering due to the sender's email address or email domain being in the blocked sender list or the blocked domain list in EOP)

  For more information about these header values, see Anti-spam message headers.

• Action: Set the spam confidence level (SCL) of these messages to 6 (spam).

This article describes how to create the required mail flow rules the Exchange admin center (EAC) and in the Exchange Management Shell (Exchange PowerShell) in the on-premises Exchange organization.

Tip

Instead of delivering the messages to the on-premises user's Junk Email folder, you can configure anti-spam policies in EOP to quarantine spam messages in EOP. For more information, see Configure anti-spam policies in EOP.

What do you need to know before you begin?

• You need to be assigned permissions in the on-premises Exchange environment before you can do these procedures. Specifically, you need to be assigned the Transport Rules role, which is assigned to the Organization Management, Compliance Management, and Records Management roles by default. For more information, see Add members to a role group.

• If and when a message is delivered to the Junk Email folder in an on-premises Exchange mailbox is controlled by a combination of the following settings:

  • The SCLJunkThreshold parameter value on the Set-OrganizationConfig cmdlet in the Exchange Management Shell. The default value is 4, which means an SCL of 5 or higher should deliver the message to the user's Junk email folder.
  • The SCLJunkThreshold parameter value on the Set-Mailbox cmdlet in the Exchange Management Shell. The default value is blank ($null), which means the organization setting is used. For details, see Exchange spam confidence level (SCL) thresholds.
  • Whether the junk email rule is enabled on the mailbox (the Enabled parameter value is $true on the Set-MailboxJunkEmailConfiguration cmdlet in the Exchange Management Shell). It's the junk email rule that actually moves the message to the Junk Email folder after delivery. By default, the junk email rule is enabled on mailboxes. For more information, see Configure Exchange antispam settings on mailboxes.

• To open the EAC on an Exchange Server, see Exchange admin center in Exchange Server. To open the Exchange Management Shell, see Open the Exchange Management Shell or Connect to Exchange servers using remote PowerShell.

• For more information about mail flow rules in on-premises Exchange, see the following articles:

  • Mail flow rules in Exchange Server
  • Mail flow rule conditions and exceptions (predicates) in Exchange Server
  • Mail flow rule actions in Exchange Server

Use the EAC to create mail flow rules that set the SCL of EOP spam messages

1. In the EAC, go to Mail flow > Rules.

2. On the Rules page, select Add > Create a new rule in the dropdown list.

3. In the New rule page that opens, configure the following settings:

   • Name: Enter a unique, descriptive name for the rule. For example:

     • EOP SFV:SPM to SCL 6
     • EOP SFV:SKS to SCL 6
     • EOP SFV:SKB to SCL 6

   • Select More Options.

   • Apply this rule if: Select A message header > includes any of these words.

     In the Enter text header includes Enter words sentence that appears, do the following steps:

     • Select the Enter text link. In the Specify header name dialog that opens, enter X-Forefront-Antispam-Report and then select OK.
     • Select the Enter words link. In the Specify words or phrases dialog that opens, enter one of the EOP spam header values (SFV:SPM, SFV:SKS, or SFV:SKB), select Add , and then select OK.

   • Do the following: Select Modify the message properties > Set the spam confidence level (SCL).

     In the Specify SCL dialog that opens, select 6 (the default value is 5).

   When you're finished on the New rule page, select Save.

Repeat these steps for the remaining EOP spam verdict values (SFV:SPM, SFV:SKS, or SFV:SKB).

Use the Exchange Management Shell to create mail flow rules that set the SCL of EOP spam messages

Use the following syntax to create the three mail flow rules:

New-TransportRule -Name "<RuleName>" -HeaderContainsMessageHeader "X-Forefront-Antispam-Report" -HeaderContainsWords "<EOPSpamFilteringVerdict>" -SetSCL 6

For example:

New-TransportRule -Name "EOP SFV:SPM to SCL 6" -HeaderContainsMessageHeader "X-Forefront-Antispam-Report" -HeaderContainsWords "SFV:SPM" -SetSCL 6

New-TransportRule -Name "EOP SFV:SKS to SCL 6" -HeaderContainsMessageHeader "X-Forefront-Antispam-Report" -HeaderContainsWords "SFV:SKS" -SetSCL 6

New-TransportRule -Name "EOP SFV:SKB to SCL 6" -HeaderContainsMessageHeader "X-Forefront-Antispam-Report" -HeaderContainsWords "SFV:SKB" -SetSCL 6

For detailed syntax and parameter information, see New-TransportRule.

How do you know this procedure worked?

To verify that you successfully configured standalone EOP to deliver spam to the Junk Email folder in hybrid environments, do any of the following steps:

• In the EAC, go to Mail flow > Rules, select the rule, and then select Edit to verify the settings.

• In the Exchange Management Shell, replace <RuleName> with the name of the mail flow rule, and run the following command to verify the settings:

  Get-TransportRule -Identity "<RuleName>" | Format-List
  

• In an external email system that doesn't scan outbound messages for spam, send a Generic Test for Unsolicited Bulk Email (GTUBE) message to an affected recipient, and confirm that the message is delivered to the Junk Email folder. A GTUBE message is similar to the European Institute for Computer Antivirus Research (EICAR) text file for testing malware settings.

  To send a GTUBE message, include the following text in the body of an email message on a single line, without any spaces or line breaks:

  XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X