none
EOP SPAM Filter RRS feed

  • Question

  • Hi,

    We have added an email address on block list on our EOP default SPAM filter. when we check on EOP, emails from this address are getting caught and marked with SCL 9 and sent to junk folder of the user mailbox.But the emails are actually getting delivered to user's inbox instead of JUNK folder. Below are the header of one of the email.

    Received: from   BY2PR29MB009.065d.mgd.msft.net (141.251.21.209) by
     DM1PR29MB013.065d.mgd.msft.net   (141.251.21.146) with Microsoft SMTP Server
     (TLS) id 15.1.453.26 via Mailbox Transport; Wed, 20 Apr 2016 00:45:18 +0000
    Received: from   BY2PR29CA004.065d.mgd.msft.net (141.251.21.205) by
     BY2PR29MB009.065d.mgd.msft.net   (141.251.21.209) with Microsoft SMTP Server
     (TLS) id 15.1.453.26; Wed, 20 Apr 2016   00:45:17 +0000
    Received: from   APC01-HK2-obe.outbound.protection.outlook.com (65.55.88.208) by
     mail.******.com (141.251.21.205) with   Microsoft SMTP Server (TLS) id
     15.1.453.26 via Frontend Transport; Wed, 20   Apr 2016 00:45:17 +0000
    Received: from   HKNPR06CA0055.apcprd06.prod.outlook.com (10.141.16.45) by
     SG2PR06MB1101.apcprd06.prod.outlook.com   (10.169.58.23) with Microsoft SMTP
     Server (TLS) id 15.1.466.19; Wed, 20 Apr   2016 00:45:14 +0000
    Received: from   DB3FFO11FD031.protection.gbl (2a01:111:f400:7e04::107) by
     HKNPR06CA0055.outlook.office365.com   (2a01:111:e400:a000::45) with Microsoft
     SMTP Server (TLS) id 15.1.466.19 via   Frontend Transport; Wed, 20 Apr 2016
     00:45:13 +0000
    Authentication-Results: spf=pass (sender   IP is 114.31.224.129)
     smtp.mailfrom=rediffmail.com; ******.com;   dkim=none (message not signed)
     header.d=none;******.com;   dmarc=bestguesspass action=none
     header.from=rediffmail.com;
    Received-SPF: Pass   (protection.outlook.com: domain of rediffmail.com
     designates 114.31.224.129 as permitted   sender)
     receiver=protection.outlook.com;   client-ip=114.31.224.129;
     helo=rediffmail.com;
    Received: from rediffmail.com   (114.31.224.129) by
     DB3FFO11FD031.mail.protection.outlook.com   (10.47.217.62) with Microsoft SMTP
     Server (TLS) id 15.1.472.8 via Frontend   Transport; Wed, 20 Apr 2016 00:45:12
    0
    Received: (qmail 17281 invoked by uid   510); 20 Apr 2016 00:44:00 -0000
    Comment: DomainKeys? See   http://antispam.yahoo.com/domainkeys
    DomainKey-Signature: a=rsa-sha1; q=dns;   c=nofws;
        s=redf; d=rediffmail.com;
        b=lqiqnpUGzKNeDLxgyMExq0Ne0pmJtP8q/w/ItVAKIHO12Dd2ccb+c8qttBPR64MaOrCqBjnH+591PhWVYfmrDIIBpqmusseMnDj1clyA655WhPOS3hF2j/5R4XejoKD6j4sMG1jn8taKfvJoLAbe31EADnYLVee1XsnL4LXRQGc=  ;
    x-m-msg: asd54ad564ad7aa6sd5as6d5;   a6da7d6asas6dasd77; 5dad65ad5sd;
    X-OUT-VDRT-SpamState: 0\LEGIT
    X-OUT-VDRT-SpamScore: 20
    X-OUT-VDRT-SpamCause:   gggruggvucftvghtrhhoucdtuddrfeekkedrieehgdeggecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddtnecuhdfknhhvihhsihgslhgvucifohhrughsucdlvddtmdenucfjughrpeffkfggvfhsuffhtgesrgdtvdertddtjeenucfhrhhomhepfdhjvggvthgtuhcufdcuoehjvggvthgtuhesrhgvughifhhfmhgrihhlrdgtohhmqeenucffohhmrghinheprhgvughifhhfrdgtohhmnecukfhppeduudehrdduudekrddvtdejrdehheenucfrrghrrghmpehmohguvgepshhmthhpohhuth
    X-Remote-IP: 115.118.207.55
    X-REDF-OSEN: jeetcu@rediffmail.com
    Date: Wed, 20 Apr 2016 00:44:00 +0000
    Message-ID:   <20160420004400.17275.qmail@f5mail-224-129.rediffmail.com>
    MIME-Version: 1.0
    To: <sanjeev.****@******.com>
    Received: from unknown 115.118.207.55 by   rediffmail.com via HTTP; 20 Apr 2016 00:44:00 -0000
    X-Senderscore: D=0&S=0
    Sender: <jeetcu@rediffmail.com>
    Subject: =?utf-8?B?VGVzdDI=?=
    From: "jeetcu "   <*****@rediffmail.com>
    Content-Type: multipart/alternative;
    Return-Path: *****@rediffmail.com
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage:   4f6e1565-c2c7-43cb-8a4c-0981d022ce20:0
    X-Forefront-Antispam-Report:   CIP:114.31.224.129;IPV:NLI;CTRY:IN;EFV:NLI;SFV:SKB;SFS:;DIR:INB;SFP:;SCL:9;SRVR:SG2PR06MB1101;H:rediffmail.com;FPR:;SPF:None;LANG:en;
    X-Microsoft-Exchange-Diagnostics:   1;DB3FFO11FD031;1:VLtuIyqcMHxBhMS6XlKCMkuB6b7aMhrzTYuv4fvWXI7Bw2U0HjlFspWKQeLGmHqdO5crgq9u5tUQHatTA4T0VEaXORb07Rq0QBTl35qjMBqeaNGHbLvGQIxezS+cb7OM1xjBy8YIug/r2kWbboReTbiXpkYhNTNlLRrV3WGXCQJd3qpnYH3lrFp3SKrcCiq1qky1V6aomzD7PnrmXS7k4Mcb+W16jNf9/ePcFgyV7MbHmh6ZTcUGPTTDmFbFB+4kR6sfdqFutOWE+MfRHVsx3p/OESCtb0Y08iCh7ah+c51/Ki16zcLq350z0vmOQTKDIfZK/3ijDCaMNpeIlTQ2a4X3mO1tQ2QRQLTvoGz7x5WCAkPaGPAVwZ+825oFUp2WBgHefxPZPeuxMx1bpM6I7usEiJ4dHa8qnpY/Pizquxtw9h4go1D5DxQwB0YOtpGyDDRCw+aKAWGualvGXc5BrbIYRVNyGFDzHweSojRMruL9FbQWIOHBDeWV2WBhEDZb
    X-MS-Office365-Filtering-Correlation-Id:   bc5ab3bf-8a03-4468-8182-08d368b50afe
    X-Microsoft-Exchange-Diagnostics:   1;SG2PR06MB1101;2:ZLyjnMq+61fM4l97tkgBO5YzHsRg71nVAXWkXUxx7M+ZbvPbMhYrFWCDhkYbzD7QVpiknhUsrNdrwos7mH4zGipS17kPOBlFb2V6JyFjmY1r75Vs3CBEDCuJ825HnW0UHFq3UHzMpvRm3IWWeudbc0F1y2fL+G3s+xNu3RtLZshLYh8HzGpCJE5UvrHFv+jD;3:LbXaaL/B/3/c/cq8NC8tFpw7V5U9rmrgh/hFVjLoqnT4TvaWAOI2Qnc+UyCjS7yS8BinX6YNRJcE/FxCaJeYxekXfZTV8r/uDwDdK4U7sQVsv9iyRivmtu6VjEwroIJVp4qRclxvOeRBLPqFXKrm03oWmMmAXZ6qAOKZNNCYC1vcugMJh5v6Io1fD2Qg+ndL8T6+Tpq5L6Gtnt8pguCP0qbm5lHVisHGmwV/drGbJTdI47ciB/7qGxnqi2UtbaztQX0XsPdUbCh9ceFbCOIK/e4kZQgbwYlkheUoo6IYhDA=
    X-Microsoft-Antispam:   UriScan:;BCL:0;PCL:0;RULEID:(8251501002)(71701004);SRVR:SG2PR06MB1101;
    X-Microsoft-Exchange-Diagnostics:   =?us-ascii?Q?1;SG2PR06MB1101;25:VBSgYr8ttkBHMAtfwZmrSgQbi3KjpCssHhxp48pMF?=
     =?us-ascii?Q?TC0g4NFe96kuf6pSLCVr9fX/1g4CVPpo95GH7CbCjling2nSOmeuQClJbu5O?=
     =?us-ascii?Q?+2lq5KwnwapoO81ca45vGOyJM4WzYmPISaj9ATBXNEbKZNPGqzeTOOSAtnF7?=
     =?us-ascii?Q?yokX22kLLlwgirmOwMieQKoiOA9zBh0ZksDd0/7idyq94g5o/DCETZOFXcB5?=
     =?us-ascii?Q?PMoQqiOOitnUq1tTrvic8zSEvBa2Oz9zFjZPHwFZdE1cCIBWSiYVgfLKbhkt?=
     =?us-ascii?Q?6PMZgUPF55LcNcYvY9qcXS/DAO3XsE1jKLjah63b/XEyE0yRDDQP0ADMZreU?=
     =?us-ascii?Q?M4GXUpvz5uAVREIMNeCsr37eIciqkFZ5AnLJ0z0CcBtx6cQ+52OrCOEFi3yr?=
     =?us-ascii?Q?jY1XLF1q9fCg2EUl523UEy3L3s6FREB2U80qQVRRmobQmNUkAQ2j7SK/kzzb?=
     =?us-ascii?Q?iV0ElXNaIObmaqFWQ+hasA3pumfUXjknyHtheFSbdWlhypjPQC+6PLhiHMT7?=
     =?us-ascii?Q?ZqHhI5A1iECZfsFM8IdMt6BvglfUv2wf5Fe10UXpbTts2uJ06VRlxgVvMmeW?=
     =?us-ascii?Q?yT1Zm6m9fkJKNKJFle8LmkHCOJgdCGs+cdUl1Eqyu2V97yBEOswezPjvKiRp?=
     =?us-ascii?Q?Qz42+jDhRmRKLb54mDIPnG/b9fDBwKuOrlDwRsXuQpi0OCqEyc3CH4kA2Bjg?=
     =?us-ascii?Q?V8XwimPCdM6jNvXlBy45GuyRXuN0Vnd2VgLwyZOvLmhR0tdNMT0UPsrRK2Y8?=
     =?us-ascii?Q?A7M7Ag6s5sPYemokIovUScFeT2pESmqqI0Vl9WDYdyWrURCEjN3NjuXvTOV5?=
     =?us-ascii?Q?iTomsE9mW4iTX8ocmYYajyXqWyF/4w3uhtLAwqB4miR6W1i6VF0peMQ6+rIW?=
     =?us-ascii?Q?1+V9FecqNaiaBVncMsWOrNcuV2c1rrmuLfQkFUfeiIDcZwjMwg4FwzmQWGdI?=
     =?us-ascii?Q?p9e6GVhSAsIjUP5YgQUQgTWQDngOJAvOVQSw2DZyw=3D=3D?=
    X-Microsoft-Exchange-Diagnostics:   1;SG2PR06MB1101;20:xjvs0c1lQgpQiQBHsWg3IigolAMpGZDOAIqF4rflJXAuSbw++qrT67yyV35PwFI2TeEIX2b2LAkoiKqxlhU6HAnObQLNkQK3RmG1ADMsa/Yzp2QwOSFuiFRiyUj1Qs9ta1jp4shkm08X3OnTEI16jA/sXowF032kQ6F9EvXodPvqeXRgh3o9rE+3ob1co8gBMx18pLJTxrIj5F/CctnZw6tEcEFGIPJHBm0rxvEMm8YBmtLShbaTGPWj51AZu0ESB2F4hOKablDvEkdTQgo3OX/i11GLhqTOOBnuTfl0rm8OBqkMI8UPicqT25BhQC4HSTYNT0Bz01qY9y7bwXAuYtpob91Vpc4SkWOQDSKmfcZ2EBa9TKTi1YDtFM6pLCQiJ2bmI2sHjKMWaXt46pHAgvVgKAts1iKKqmRXVZP8HeUGvHIAFcbejp1hyPLskc4PdWLAB6+FQ7jSFRl2t76vVOVx9cnAd6kA1YCg2IuvOwq0hQndmCl1HfrTHrxsjeVn;4:oM5HdOpJEu54EWaHSjm2x3Ufgcv15xk3JOHvL+TlH+vtnGKUbpOGYzc8Kjd1NTObWwQXC3ahFGDWV9ZQ1jhF1I2H4snDEi+LDGNA35YVmA/M8FVPs3gW+itrRT6mXmg6EfBUO/VCkmW3OFuyuY6UZjDBqHGE9NRe6f5PmECxkJGgwKz/o+fyH2uWunvrwQVMAwHcIuzrkgOKmCKWdAg5d8THAwn6IXowpPR9nWzPZa2VVjydQwP7gDJS0fZAca6PC3aLZWH7Kmk/yYxJLPbyPg==
    X-Exchange-Antispam-Report-CFA-Test:   BCL:0;PCL:0;RULEID:(41302006);SRVR:SG2PR06MB1101;BCL:0;PCL:0;RULEID:;SRVR:SG2PR06MB1101;
    X-Microsoft-Exchange-Diagnostics:   1;SG2PR06MB1101;23:MU75wxo6qsQedvJGmirshAM5/6P98UMFtwAmTLKtKNZAwSplG201HXTnYUM/OnUIvrsyzmfJ1/CN3iqs1XCeM9/3srljPmSxkfsqK2iNZoWfvGgxPYgYfTsvuZjpSTE6BdBGPMN7ivaSDQ1/y+Eo/I0261PjN33AVY3XaVobU8DeNOYM32jV4KTRmLgxOv9jL6MqY6ounNLFmqQFdWDAzQ==;5:fNE4cfKcnqfq0dinq22gG1O0if6vmLJRgK02E53Eds3S2hguKSlOqIIRz+mj74AgfxyBmGSTbXy9zf8qJijc2EEPg9UJauqJrKBiJ0a2aFTdhKB2xCVvLlodiGvyd424PxkPIQPhKyGV/eTbFl1DsS0jvsC362fpebwYmUATkrbOMGGc0LqpIHngOQqE6DeE;24:RMuI/oTNRk83AwMed/En374J+Nmu6r5kIy6+/DVI65xn5DjlE+fUDHgml1LkLQ6jGXw0lyyscuIKtx/e0Ebvuw==;7:+/HPC9HaC30Q1YEPq9HgwDcVb1IK7XXzNnEJEw3v3J0iXrq9hNFRSlIfv74NnQH4J9fFyfZIx6HNkNSI3liaSSunYqC81YpLsN/tnPy/E7aKHKiOPFaDSoXs+jOfcVuwHwNZ449sN/vX4HTUoDJJkHVqWt1fW/JInnB59ebxSuWoGgLJpzXTWJDfnEdvIW/C17tScxkKUayqoSPFZbezJlPRI3MRI3piIzRxUrNWpq8=
    SpamDiagnosticOutput: 1:25
    SpamDiagnosticMetadata:   00000000%2D0000%2D0000%2D0000%2D000000000000
    X-MS-Exchange-CrossTenant-OriginalArrivalTime:   20 Apr 2016 00:45:12.2484
     (UTC)
    X-MS-Exchange-CrossTenant-Id:   4f6e1565-c2c7-43cb-8a4c-0981d022ce20
    X-MS-Exchange-CrossTenant-FromEntityHeader:   Internet
    X-MS-Exchange-Transport-CrossTenantHeadersStamped:   SG2PR06MB1101
    X-MS-Exchange-Organization-Network-Message-Id:   bc5ab3bf-8a03-4468-8182-08d368b50afe
    X-MS-Exchange-Organization-AVStamp-Enterprise:   1.0
    X-MS-Exchange-Organization-AuthSource:   BY2PR29CA004.065d.mgd.msft.net
    X-MS-Exchange-Organization-AuthAs:   Anonymous
    X-OriginatorOrg: ****.onmicrosoft.com

    X-MS-Exchange-Transport-EndToEndLatency:   00:00:01.9800673

    What could be the issue here?

    Regards,

    Wednesday, April 20, 2016 6:57 PM