Thank you Jim for your reply.
The only AV we use is SCEP, no other 3rd party AV software in the Organization. Also no other software besides Exchange Edge 2016 Server is installed on our Edge.
The spam quarantine mailbox exists and it was working with our old Exchange 2010 servers (Edge+Mailbox).
The Transport Agents are enabled.
[PS] C:\>Get-TransportAgent
Identity
Enabled Priority
--------
------- --------
Connection Filtering Agent True 1
Address Rewriting Inbound Agent True 2
Edge Rule Agent True
3
Content Filter Agent True
4
Sender Id Agent True
5
Sender Filter Agent True
6
Recipient Filter Agent True
7
Protocol Analysis Agent True
8
Attachment Filtering Agent True 9
Address Rewriting Outbound Agent True 10
The Content Filter is enabled and configured
[PS] C:\>Get-ContentFilterConfig | Format-List Enabled
Enabled : True
[PS] C:\>Get-ContentFilterConfig
Name : ContentFilterConfig
RejectionResponse : Server rejected your message as spam by Content Filtering.
OutlookEmailPostmarkValidationEnabled : True
BypassedRecipients : {}
QuarantineMailbox :
spam.quarantine@<MyDomain>
SCLRejectThreshold : 7
SCLRejectEnabled : False
SCLDeleteThreshold : 9
SCLDeleteEnabled : False
SCLQuarantineThreshold : 7
SCLQuarantineEnabled : True
BypassedSenders : {}
BypassedSenderDomains : {}
Enabled : True
ExternalMailEnabled : True
InternalMailEnabled : False
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
DistinguishedName : CN=ContentFilterConfig,CN=Message Hygiene,CN=Transport Settings,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,CN={C8588207-0E3D-42D9-B301-3DAA8AFF5797}
Identity : ContentFilterConfig
Guid : 7cff7013-2346-422d-86aa-e283c7e8ee8f
ObjectCategory : CN=ms-Exch-Message-Hygiene-Content-Filter-Config,CN=Schema,CN=Configuration,CN={C8588207-0E3D-42D9-B301-3DAA8AFF5797}
ObjectClass : {top, msExchAgent, msExchMessageHygieneContentFilterConfig}
WhenChanged : 5/16/2016 4:05:21 PM
WhenCreated : 3/10/2016 3:52:11 PM
WhenChangedUTC : 5/16/2016 3:05:21 PM
WhenCreatedUTC : 3/10/2016 3:52:11 PM
OrganizationId :
Id : ContentFilterConfig
OriginatingServer : localhost
IsValid : True
ObjectState : Unchanged
Here the agent log:
Timestamp : 5/17/2016 9:39:41 AM
ClientIp :
ClientHostname :
ServerIp :
ServerHostname : <MyEdgeServer>
SourceContext : Quarantine
ConnectorId :
Source : DSN
EventId : DSN
InternalMessageId : 6983616823427
MessageId : <25056246861230.851kgo82701gn@gmacdonalddds.com>
NetworkMessageId : b1367d6a-b307-460f-efe3-08d37e2eca57
Recipients :
{spam.quarantine@<MyDomain>}
RecipientStatus : {}
TotalBytes : 24031
RecipientCount : 1
RelatedRecipientAddress :
Reference : {<25056246861230.851kgo82701gn@gmacdonalddds.com>}
MessageSubject : Undeliverable: Spam Pfizer's caplet for me that want more.
Sender :
postmaster@<MyDomain>
ReturnPath : <>
Directionality : Originating
TenantId :
OriginalClientIp :
MessageInfo : <Hayes_Lynnette@cnahfs.com],
[AccountForest, localhost]}
TransportTrafficType : Email
Timestamp : 5/17/2016 9:39:46 AM
ClientIp :
ClientHostname :
ServerIp :
ServerHostname : <MyEdgeServer>
SourceContext :
ConnectorId :
Source : DSN
EventId : BADMAIL
InternalMessageId : 6983616823427
MessageId : <25056246861230.851kgo82701gn@gmacdonalddds.com>
NetworkMessageId : b1367d6a-b307-460f-efe3-08d37e2eca57
Recipients :
{spam.quarantine@<MyDomain>}
RecipientStatus : {}
TotalBytes : 24031
RecipientCount : 1
RelatedRecipientAddress :
Reference :
MessageSubject : Undeliverable: Spam Pfizer's caplet for me that want more.
Sender :
postmaster@<MyDomain>
ReturnPath : <>
Directionality : Originating
TenantId :
OriginalClientIp :
MessageInfo :
MessageLatency :
MessageLatencyType : None
EventData : {[BadmailReason, NDRing a mail recipient that requires a DSN], [DeliveryPriority, Normal],
[OriginalFromAddress,
Hayes_Lynnette@cnahfs.com], [AccountForest, localhost]}
TransportTrafficType : Email
Timestamp : 5/17/2016 9:39:46 AM
ClientIp : <MyEdgeServerIPAddress>
ClientHostname : <MyEdgeServer>
ServerIp : <MyMailboxServerIPAddress>
ServerHostname : <MyMailboxServerIPAddress>
SourceContext :
ConnectorId : EdgeSync - Inbound to FirstSite
Source : SMTP
EventId : FAIL
InternalMessageId : 6983616823427
MessageId : <25056246861230.851kgo82701gn@gmacdonalddds.com>
NetworkMessageId : b1367d6a-b307-460f-efe3-08d37e2eca57
Recipients :
{spam.quarantine@<MyDomain>}
RecipientStatus : {[{LRT=5/17/2016 8:39:41 AM};{LED=550 5.7.53 SMTP; Command not authorized in current state};{FQDN=<MyMailboxServerIPAddress>};{IP=<MyMailboxServerIPAddress>}]}
TotalBytes : 24031
RecipientCount : 1
RelatedRecipientAddress :
Reference :
MessageSubject : Undeliverable: Spam Pfizer's caplet for me that want more.
Sender :
postmaster@<MyDomain>
ReturnPath : <>
Directionality : Originating
TenantId :
OriginalClientIp :
MessageInfo : 2016-05-17T08:39:41.772Z;SRV=<MyEdgeServer>:TOTAL-EDGE=5.065|UTH=0.002|DSN=0.005|CAT=0.002|
SMSC=0.027|SMS=5.016
MessageLatency :
MessageLatencyType : None
EventData : {[E2ELatency, 5.049], [ExternalSendLatency, 0.000], [ToEntity, Unknown], [FromEntity,
Hosted], [ToEntity, Internet], [FromEntity, Hosted],
[Microsoft.Exchange.Transport.MailRecipient.RequiredTlsAuthLevel, Opportunistic],
[DeliveryPriority, Normal], [OriginalFromAddress,
Hayes_Lynnette@cnahfs.com],
[AccountForest, localhost]}
TransportTrafficType : Email
Hope you can help me.
Best regards,
Fernando
Edge AntiSpam mail flow to Quarantine Mailbox
