none
Exchange server 2013 content filter rejecting all incoming messages as spam. RRS feed

  • Question

  • Hello All,

    Today out of the blue our Exchange server 2013 install started rejecting any inbound message as spam. It first started with only one user not being able to receive any mail because of this anomaly and then after 12 or so hours all users were getting their mail rejected.

    I currently had the threshold set to 5 on external messages only. Internal is disabled.

    I have tried setting the threshold to 8 and 9, and rebooted the server after restarting all services just to make sure everything reset. Even dished out a IISRESET just in case. Whatever I tried still does not work.

    The install is a stand alone server facing the outside world (no edge server) living in a 2 domain controller environment with a share point farm thrown in (ESXI5.5 environment) Everything works just fine and dandy if I disable the content filter all together. Not seeing anything in the application logs out of the ordinary. Everything was working great and the same settings I used on this server worked well for a totally different server that runs just fine.

    Any ideas?



    fr0stsp1re

    Thursday, May 29, 2014 4:18 AM

All replies

  • Hi,

    Share the output of Get-ContentFilterConfig

    Also share the Agentlogs output please.


    Regards, Pushkal MishrA, This posting is provided “AS IS” with no warranties and confers no rights. I request you to test the solution in lab and post successful outcome you should try this on production.

    Monday, June 9, 2014 1:50 PM
  • Any update please?

    Regards, Pushkal MishrA, This posting is provided “AS IS” with no warranties and confers no rights. I request you to test the solution in lab and post successful outcome you should try this on production.

    Wednesday, June 11, 2014 5:47 AM
  •  

    RunspaceId                            : 87157b62-a061-436b-8fb9-dab446be3473
    Name                                  : ContentFilterConfig
    RejectionResponse                     : Message rejected as spam by Content Filtering.
    OutlookEmailPostmarkValidationEnabled : True
    BypassedRecipients                    : {}
    QuarantineMailbox                     :
    SCLRejectThreshold                    : 6
    SCLRejectEnabled                      : False
    SCLDeleteThreshold                    : 9
    SCLDeleteEnabled                      : False
    SCLQuarantineThreshold                : 9
    SCLQuarantineEnabled                  : False
    BypassedSenders                       : {}
    BypassedSenderDomains                 : {}
    Enabled                               : False
    ExternalMailEnabled                   : True
    InternalMailEnabled                   : False
    AdminDisplayName                      :
    ExchangeVersion                       : 0.1 (8.0.535.0)
    DistinguishedName                     : CN=ContentFilterConfig,CN=Message Hygiene,CN=Transport Settings,CN=Smith And
                                            Smith,CN=Microsoft
                                            Exchange,CN=Services,CN=Configuration,DC=XXXXXXXXXXX,DC=com
    Identity                              : ContentFilterConfig
    Guid                                  : 8f86e0b6-da37-42d3-b7cd-b9635b7db271
    ObjectCategory                        : XXXXXXXXXXXXXXXXXXX/Configuration/Schema/ms-Exch-Message-Hygiene-Conten
                                            t-Filter-Config
    ObjectClass                           : {top, msExchAgent, msExchMessageHygieneContentFilterConfig}
    WhenChanged                           : 5/28/2014 12:15:21 PM
    WhenCreated                           : 5/1/2014 4:17:55 PM
    WhenChangedUTC                        : 5/28/2014 7:15:21 PM
    WhenCreatedUTC                        : 5/1/2014 11:17:55 PM
    OrganizationId                        :
    OriginatingServer                     : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    IsValid                               : True
    ObjectState                           : Unchanged

     

     This is what it is set at now. Completely disabled. It worked fine for quite some time filtering out spam pretty nicely then one day everyone's mail was being rejected as spam by the content filtering agent. I know of someone else who also had this issue except their box was running 2008R2 with EX2007. They too disabled the content filter as it was giving them too many problems with mail being rejected.


    fr0stsp1re

    Wednesday, June 11, 2014 5:34 PM
  • Hmmmmmm....since you have it disabled then no point of further troubleshooting  yet for the discussion sake..The rejection of the message would be strictly based on the action of a particular SCL rating....Ideally it shouldn't be rejecting all the messages....for more information on SCL is well documented in the article below
    http://technet.microsoft.com/en-in/library/aa995744(v=exchg.150).aspx

    Also, please review the NDR message to validate if they're in fact rejected by Content Filter and validate the SCL rating on message header vis-à-vis with actually configured on content filter.

    Also check to see when was the latest content filter update is applied(update data is updated and available for download every two weeks).

     


    Regards, Pushkal MishrA, This posting is provided “AS IS” with no warranties and confers no rights. I request you to test the solution in lab and post successful outcome you should try this on production.

    Thursday, June 12, 2014 12:09 PM