none
Hybrid Exchange: anti-spam transport rules for EOP headers on on-premise Exchange 2010 not applying.

    Question

  • Hi

    I created the 3 transport rules on the on-premise Exchange mentioned in this article:

    https://technet.microsoft.com/en-us/library/jj837173(v=exchg.150).aspx

    These rules are not applying, in a test message I verified that the mentioned header
    X-Forefront-Antispam-Report is populated:

    CIP:40.92.65.88;IPV:NLI;CTRY:US;EFV:NLI;SFV:SPM;SFS:(8156002)(2980300002)(438002)(199004)(189003)(5000100001)(1096003)(102836004)(26005)(33656002)(19627405001)(7636002)(83332001)(356003)(104016004)(6436002)(61614004)(99286004)(106466001)(87572001)(16003)(450100002)(246002)(74316002)(53376002)(54896002)(9686003)(86362001)(16297215004)(2900100001)(55016002)(336012)(6306002)(25786009)(6506007)(82202002)(86152003)(8676002)(7696005)(53336002)(106002)(62560400003)(73972006)(486006)(236005)(606006)(126002)(110136005)(476003)(16586007)(14454004)(5660300001)(7116003)(2160300002)(5250100002)(966005)(2501003)(84326002)(59010400001);DIR:INB;SFP:;SCL:5;SRVR:AM3PR06MB0964;H:EUR01-HE1-obe.outbound.protection.outlook.com;FPR:;SPF:Pass;LANG:de;PTR:mail-oln040092065088.outbound.protection.outlook.com;A:1;MX:1;CAT:PHSH;

    The header contains "SFV:SPM" so the first rule should be applying... I checked the message tracking log for the test message but it just delivers...

    I enabled pipeline tracing on the on-premise transport hubs but no rule tracking files are created (even though a different rule was applied).

    Any ideas?

    Friday, June 08, 2018 10:40 AM

All replies

  • Hi.

    Please check your rule and enable for every rule - Stop processing more rules.

    Mail flow rule actions in Exchange Online Protection

    Properties of this rule section > Stop processing more rules

    More options > Properties of this rule section > Stop processing more rules

    StopRuleProcessing

    n/a

    Specifies that after the message is affected by the rule, the message is exempt from processing by other rules.


    MCITP, MCSE. Regards, Oleg

    Friday, June 08, 2018 11:23 AM
  • Hi Oleg

    Note that even though I posted it in the Exchange Online forum (due to it being an hybrid environment), the transport rules are located on the on-premise Exchange where I don't have that option.

    Friday, June 08, 2018 11:42 AM
  • Hi Glenn.

    1. This is rule available in EOP and you must be added Stop processing more rules in EOP.

    2. Check again this instruction, because it's works.

    Ensure that spam is routed to each user's Junk Email folder

     And last. 

    Public full email with all metadate or you can analyze on this site. https://testconnectivity.microsoft.com/

    Other way open case in EOP MS support, if you can't public full body email. 

    MS Support can generate test email for your domain and your rule.

    You don't need pay for case in EOP support.  


    MCITP, MCSE. Regards, Oleg

    Saturday, June 09, 2018 12:46 AM
  • Hi,

    Any further help we can do for you?
    If it's solved, would you please post the solution here to share it with us? Thanks.
    Also, please free to mark the useful reply as answer. Thanks for your cooperation.

    Best Regards,
    Allen Wang


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Friday, June 15, 2018 1:53 AM
    Moderator
  • Hi,

    Sorry to interrupt your again.
    I just want to check the current status of your question.
    Is there any update or any other assistance I could provide on this issue? 

    Please feel free to mark responses as the answer and/or vote them helpful as appropriate.
    Thank you for your understanding and patience! 

    Best Regards,
    Allen Wang


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Monday, July 02, 2018 1:59 AM
    Moderator