Need help to control Spam



    Dear All,

    We are getting bulk spams and Microsoft Forefront application is unable to block those emails. All are those mails are like notice, court notice.

    Forefront is just blocking its virus infectected attachments but passing spam to reach end users.

    All the times it’s coming from different sender email id, different domains and IP address so it’s very difficult to block by these attributes.

    Please find below message header sample

    Received: from ( by (192.168.12) with Microsoft SMTP Server (TLS)

     id 14.2.318.1; Wed, 5 Feb 2014 02:46:35 +0530

    Received: from ( by (

    with Microsoft SMTP Server id 14.2.318.1; Wed, 5 Feb 2014

     12:25:47 +0530

    Message-ID: <002201cf223f47f4d62c0200a8c0@Ron-PC>

    From: Notice to quit <>

    To: <>

    Subject: SUSPECT: Notice to quit No3443

    Date: Wed, 5 Feb 2014 16:55:40 +1100

    MIME-Version: 1.0

    Content-Type: multipart/mixed;


    X-Priority: 3

    X-MSMail-Priority: Normal

    X-Mailer: XimianEvolution1.4.6

    X-MimeOLE: Produced By XimianEvolution1.4.6


    Received-SPF: Neutral ( is neither

     permitted nor denied by domain of


    X-MS-Exchange-Organization-AuthAs: Anonymous

    Need your help to resolve this issue.

    Wednesday, February 05, 2014 10:57 AM


All replies

  • Hi,

    if the email contains a virus set the action to purge, so the email won't be delivered to the recipient. In addition you can set the option to quarantine emails so you can access those emails in quarantine if you need them.



    Christian Groebner MVP Forefront

    Wednesday, February 05, 2014 8:49 PM
  • Thanks for you suggestions Christian,

    But I am unable to find those option,please guide me with exact procedure to do so.


    Ketan Tande

    Thursday, February 06, 2014 5:16 AM
  • Hi Ketan,

    you can configure the options for the transport scan here:

    If you need further assistance please let me know.



    Christian Groebner MVP Forefront

    Thursday, February 06, 2014 7:58 AM
  • Hi,

    If you wanted to configure a quarantine mailbox address, please click E-mail Policy, then click the Spam Filtering tab, click Content Filtering, and then click the SCL Thresholds tab. On the SCL Thresholds tab, select the Quarantine messages that have an SCL rating greater than or equal to check box, then specify a threshold and then provide a valid quarantine mailbox address.

    More information:

    Configuring spam filtering

    Best regards,


    Thursday, February 06, 2014 8:58 AM