Exchange 2013 not sending email to Junk Folder

JaredBusch

I have mail with the junk header set, but not oing into the junk folder.

My google is not working worth a shit this morning. Can anyone point me in a good direction?

SCL:5 means spam.
CAT:PHISH means spam

But it is in the inbox.

X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64b13977-e368-48dd-a7b1-c4b988436e43:0
X-Forefront-Antispam-Report: CIP:142.0.162.30;IPV:;CTRY:US;EFV:NLI;SFV:SPM;SFS:(10001);DIR:INB;SFP:;SCL:5;SRVR:SN6PR08MB5104;H:e30.dc6.en25.com;FPR:;SPF:None;LANG:en;CAT:PHISH;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: b8658f06-46bb-48e6-69c4-08d7cff7daaf
X-MS-TrafficTypeDiagnostic: SN6PR08MB5104:
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;
X-Microsoft-Antispam: BCL:0;

According to a user, nothing is going into junk mail for anyone.

manxam

What's your SCL Junk Email folder threshold set to? I believe it defaults to 4 but perhaps it's worth a look.

JaredBusch

@manxam said in Exchange 2013 not sending email to Junk Folder:

What's your SCL Junk Email folder threshold set to? I believe it defaults to 4 but perhaps it's worth a look.

Where TF do I find that setting in ECP?

manxam

@JaredBusch : It's a powershell only setting -- or at least this is the only place I've ever set it on prem. O365 does it through EAC mail rules.

https://docs.microsoft.com/en-us/exchange/spam-confidence-level-threshold-exchange-2013-help

JaredBusch

@manxam said in Exchange 2013 not sending email to Junk Folder:

@JaredBusch : It's a powershell only setting -- or at least this is the only place I've ever set it on prem. O365 does it through EAC mail rules.

https://docs.microsoft.com/en-us/exchange/spam-confidence-level-threshold-exchange-2013-help

Well I never disabled this, so WTF with it not working.. signing in to test.

JaredBusch

Yup.. WTF, it is not enabled.

[PS] C:\Windows\system32>Get-ContentFilterConfig

RunspaceId                            : 13e0ee15-e9e9-4d5b-84b5-7e4be4ecbf40
Name                                  : ContentFilterConfig
RejectionResponse                     : Message rejected as spam by Content Filtering.
OutlookEmailPostmarkValidationEnabled : True
BypassedRecipients                    : {}
QuarantineMailbox                     :
SCLRejectThreshold                    : 7
SCLRejectEnabled                      : True
SCLDeleteThreshold                    : 9
SCLDeleteEnabled                      : False
SCLQuarantineThreshold                : 9
SCLQuarantineEnabled                  : False
BypassedSenders                       : {}
BypassedSenderDomains                 : {}
Enabled                               : False
ExternalMailEnabled                   : True
InternalMailEnabled                   : False
AdminDisplayName                      :
ExchangeVersion                       : 0.1 (8.0.535.0)
DistinguishedName                     : CN=ContentFilterConfig,CN=Message Hygiene,CN=Transport Settings,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=local
Identity                              : ContentFilterConfig
Guid                                  : cacf4374-c823-4fb4-9774-970f3e665d3f
ObjectCategory                        : domain.local/Configuration/Schema/ms-Exch-Message-Hygiene-Content-Filter-Config
ObjectClass                           : {top, msExchAgent, msExchMessageHygieneContentFilterConfig}
WhenChanged                           : 11/02/2014 15:00:01
WhenCreated                           : 07/23/2011 16:19:01
WhenChangedUTC                        : 11/02/2014 21:00:01
WhenCreatedUTC                        : 07/23/2011 21:19:01
OrganizationId                        :
Id                                    : ContentFilterConfig
OriginatingServer                     : DC02.domain.local
IsValid                               : True
ObjectState                           : Unchanged

JaredBusch

Users are null. which mans it would only be using the above disabled global policy.
[PS] C:\Windows\system32>Get-Mailbox someuser | Format-List SCL*,Bypass*,*SenderAuth*

SCLDeleteThreshold                   :
SCLDeleteEnabled                     :
SCLRejectThreshold                   :
SCLRejectEnabled                     :
SCLQuarantineThreshold               :
SCLQuarantineEnabled                 :
SCLJunkThreshold                     :
SCLJunkEnabled                       :
BypassModerationFromSendersOrMembers : {}
RequireSenderAuthenticationEnabled   : False

JaredBusch

@JaredBusch said in Exchange 2013 not sending email to Junk Folder:

Get-ContentFilterConfig

Can anyone else with an on-prem Exchange server tell be what their settings here are?

Get-ContentFilterConfig

JaredBusch

I've set this.

Set-OrganizationConfig -SCLJunkThreshold 4

now to wait and see what happens.

manxam

@JaredBusch :

RunspaceId                            : 14a9f9e7-80a4-4a8f-86eb-a44d6038b921
Name                                  : ContentFilterConfig
RejectionResponse                     : Message rejected as spam by Content Filtering.
OutlookEmailPostmarkValidationEnabled : True
BypassedRecipients                    : {}
QuarantineMailbox                     :
SCLRejectThreshold                    : 7
SCLRejectEnabled                      : True
SCLDeleteThreshold                    : 9
SCLDeleteEnabled                      : False
SCLQuarantineThreshold                : 9
SCLQuarantineEnabled                  : False
BypassedSenders                       : {}
BypassedSenderDomains                 : {}
Enabled                               : True
ExternalMailEnabled                   : True
InternalMailEnabled                   : False
AdminDisplayName                      :
ExchangeVersion                       : 0.1 (8.0.535.0)
DistinguishedName                     : CN=ContentFilterConfig,CN=Message Hygiene,CN=Transport
                                        Settings,CN=Mail,CN=Microsoft
                                        Exchange,CN=Services,CN=Configuration,DC=Mail,DC=contoso,DC
Identity                              : ContentFilterConfig
Guid                                  : a21710e1-71a9-40b8-ac79-8655de1cc5ef
ObjectCategory                        : Mail.Consoto.com/Configuration/Schema/ms-Exch-Message-Hygien
                                        onfig
ObjectClass                           : {top, msExchAgent, msExchMessageHygieneContentFilterConfig}
WhenChanged                           : 10/13/2015 12:01:31 PM
WhenCreated                           : 10/13/2015 12:01:31 PM
WhenChangedUTC                        : 10/13/2015 4:01:31 PM
WhenCreatedUTC                        : 10/13/2015 4:01:31 PM
OrganizationId                        :
Id                                    : ContentFilterConfig
OriginatingServer                     : data.Mail.Consoto.com
IsValid                               : True
ObjectState                           : Unchanged

manxam

Note the when created and when changed on yours vs mine.
This one is default enabled.
Yours appears to have changed 3 years after setup.

Is it possible that this company had an external mail filter at some point?

JaredBusch

@manxam said in Exchange 2013 not sending email to Junk Folder:

Note the when created and when changed on yours vs mine.
This one is default enabled.
Yours appears to have changed 3 years after setup.

Is it possible that this company had an external mail filter at some point?

2014 is 6 years ago..That is when I upgraded them from SBS 2008 R2 to Server 2012 R2 with Exchange 2013.

The SBS instance was not set up by me and I never changed these settings. They have had Postini for years until Google screwed it. So it is entirely possible their prior admin disabled this for some reason.

manxam

Wonder if this is a legacy setting brought forward from SBS 2008.. Regardless, changing it to 4 like you did should likely fix your issue going forward.

JaredBusch

@manxam said in Exchange 2013 not sending email to Junk Folder:

Wonder if this is a legacy setting brought forward from SBS 2008.. Regardless, changing it to 4 like you did should likely fix your issue going forward.

Possibly. Time will tell if mail start going to Junk or not.