none
Exchange online - Mail flow rules

    Question

  • We just had an email bypass the other two rules and we need to have a recommendation on how to fix this,

    ·         The first rule checks the message header “X-Forefront-Antispam-Report” for containing “SFV:SPM”. The email had this, but the rule was ignored.

    ·         The second rule checks the header “X-MS-Exchange-Organization-SCL” for containing “9’ or ‘8’ or ‘7’ or ‘6’ or ‘5”. The email had an SCL of 5, but this was also ignored.

    ·         The third rule is setup the same as the second, but checks header “X-Microsoft-Antispam” and has been working fine, however the email that we’re concerned about had a BCL of 0 so it didn’t apply.

    We can’t figure out why the first two rules didn’t catch the email. below is the header of that email. You can see it fits the conditions for the first two rules:

    Received: from DM5PR19MB1067.namprd19.prod.outlook.com (10.168.120.144) by
     CY4PR19MB1062.namprd19.prod.outlook.com (10.173.185.145) with Microsoft SMTP
     Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
     15.1.947.12 via Mailbox Transport; Wed, 8 Mar 2017 23:11:49 +0000
    Received: from DM3PR19MB0652.namprd19.prod.outlook.com (10.164.249.136) by
     DM5PR19MB1067.namprd19.prod.outlook.com (10.168.120.144) with Microsoft SMTP
     Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
     15.1.947.12; Wed, 8 Mar 2017 23:11:49 +0000
    Received: from BL2PR19CA0032.namprd19.prod.outlook.com (10.167.113.42) by
     DM3PR19MB0652.namprd19.prod.outlook.com (10.164.249.136) with Microsoft SMTP
     Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
     15.1.947.12; Wed, 8 Mar 2017 23:11:47 +0000
    Received: from BN1AFFO11FD045.protection.gbl (2a01:111:f400:7c10::126) by
     BL2PR19CA0032.outlook.office365.com (2603:10b6:201:f::42) with Microsoft SMTP
     Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
     15.1.961.14 via Frontend Transport; Wed, 8 Mar 2017 23:11:47 +0000
    Authentication-Results: spf=pass (sender IP is 199.229.249.18)
     smtp.mailfrom=petes-tech.com; snpcpa.com; dkim=pass (signature was verified)
     header.d=petes-tech.com;snpcpa.com; dmarc=pass action=none
     header.from=petes-tech.com;
    Received-SPF: Pass (protection.outlook.com: domain of petes-tech.com
     designates 199.229.249.18 as permitted sender)
     receiver=protection.outlook.com; client-ip=199.229.249.18;
     helo=mail.petes-tech.com;
    Received: from mail.petes-tech.com (199.229.249.18) by
     BN1AFFO11FD045.mail.protection.outlook.com (10.58.53.60) with Microsoft SMTP
     Server id 15.1.947.7 via Frontend Transport; Wed, 8 Mar 2017 23:11:47 +0000
    DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=petes-tech.com;
     h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=x700_tactical_flashlight@petes-tech.com;
     bh=XwKHhE0moimj4ZLgHonuP3aRao4=;
     b=gQvoG1jMYoQVF+1hj50xTbY+1OdDq6+xvOiw9E88bIbd7abkClINKqP8Bslkedi0MJQUvze7alLY
       QUxeViwI9t3HW5qk7ot5rEsWuf/5L1WSMWQlz9l+sYSL2+lAuBZ4PRRt+f8Pxk0EZxgB7QXCmQKy
       YJzKGUOXAH4r1prkaIo=
    DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=petes-tech.com;
     b=kGX1+1vlAwkUUhmPqHyUhPwbvdJwynijp/uRAVaM8nxnCa8kfNdHpQ03REEmc6x+M/1dNUH4dzw1
       0OiVDdqXU4cuxoaYTdP8sgfoFX2ILQ7PYG3Np8xloXk1uwHtVm+K2fXkkj7ocvVzBcEHe0e+jTwZ
       3kKb59Q7As6Q6MzrFxg=;
    Received: by mail.petes-tech.com id ho27r60001g0 for <>; Wed, 8 Mar 2017 17:05:27 -0600 (envelope-from <x700_tactical_flashlight-it=snpcpa.com@petes-tech.com>)
    Date: Wed, 8 Mar 2017 17:05:27 -0600
    From: "X700 Tactical Flashlight" <x700_tactical_flashlight@petes-tech.com>
    To: <>
    Subject: !NDR/Sender FAIL! --  Get the New X700 Tactical Flashlight for a
     Limited time at 75% OFF
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
     boundary="----=_Part_199_1619908673.1489014320084"
    X-SMTPAPI: {"category": "20170308-170154-895-5119"}
    List-Unsubscribe: <http://www.petes-tech.com/yellow/d328Qj9z11_k136equVFmhjMjKzMig7de>
    Feedback-ID: 201703081701548955119
    Message-ID: <0.0.0.16.1D2986079D1E822.124612@mail.petes-tech.com>
    Return-Path: x700_tactical_flashlight-it=snpcpa.com@petes-tech.com
    X-MS-Exchange-Organization-Network-Message-Id: 9aa5b348-61fb-4a9b-658e-08d466787ebb
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: f7d95f28-fa3e-4ffa-be97-555a86a2d8a7:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Forefront-Antispam-Report: CIP:199.229.249.18;IPV:NLI;CTRY:;EFV:NLI;SFV:SPM;SFS:(8206002)(2990300002)(438002)(199003)(189002)(9170700003)(19618635001)(6986002)(5660300001)(5000100001)(104016004)(733005)(104066001)(980100002)(356003)(42186005)(106466001)(21004)(55930200001)(84326002)(861006)(50986999)(8676002)(270700001)(7906003)(606005)(6306002)(7066003)(95666005)(110136004)(54356999)(55920200001)(85226003)(966004)(5002050100002)(2351001)(189998001)(33656002)(575784001)(946001)(6862004)(2160300002)(236005)(81166006)(231993002)(1096003)(47976999)(58536013)(146002)(450100002)(1720100001)(956001)(85166004)(103116003)(7099028)(44190200005)(103106002);DIR:INB;SFP:;SCL:5;SRVR:DM3PR19MB0652;H:mail.petes-tech.com;FPR:;SPF:Pass;MLV:ovrspm;A:1;MX:1;PTR:atl.dedidirect.com;CAT:SPM;LANG:en;
    X-Microsoft-Exchange-Diagnostics: 1;BN1AFFO11FD045;1:ez2zMH2/dk8AG0jSMczWXRmQQr1CYvfrjBIxPkH5nJp40HDgZGaw320Q1GtWPA22kKdj5noaViQF8lbiswQTFWoCupImQTX3SA32Gb5BM0CRt7bIU5xEVASOCXYTedSvBgIBty4rwuGZm7mEuqVeTMTqBGM/2/fmI/cwAj+vV7gAtKtarBh8F8Ho+NST8aPbru1+YXK0JOgCd083AdCgiVfzMP+a1gwtPnf9YHIjUEIvI9Gc3dskDyf8fXz1MdLTR42yaVR30ENIyJ06dFdo9UuEAzd4XzkHrmlYC8X4aF67uFRE6o4Tf7CttzRJ4NSlVghScNXY0l0wV49x5/j9P6/megfor4AupzidZAFOkiqgQZ/pqT9Wb6m6upcrbtxY0bOdvUt3YLMIxuttMbgPsbKWmJgDUYES5sU1cZ1a4TSRDmgZ/37Wi1EDZCoWKSG9wLslF2hnLOfQ5RTm/N/awpYgY/Of9TYa4tnq5/HRt7OqM5dtqXrcT+0PkTt0cqsdGk1We2H+a8xwVvRz4ZCG5Hs8iYUSzdYAf223A6mcpCcRHtGBzU0SseujjAxFG2m9F9mZUQ3ZZhpPQptzc0QVew4zvloHuO/IlTlTxMKsefrmO4xDM/SjpYxOONcC2Xzzd9NxKvtk4mqDJBw9IRPgGQ==
    X-MS-Office365-Filtering-Correlation-Id: 9aa5b348-61fb-4a9b-658e-08d466787ebb
    X-DkimResult-Test: Passed
    X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(421252002)(81800161)(8251501002)(3001016)(3010002)(71702078);SRVR:DM3PR19MB0652;
    X-Microsoft-Exchange-Diagnostics: 1;DM3PR19MB0652;3:cMIrxE6m8rK9oczfTNpurOXNJ9C5lq8X3k4VKqBZN1PLiC7nCCoLIH80Zp7wW/IAA4E1EcNH9aRepg0c/xCaXJ3J3mWK3Zwf3OmqRtQiLTvX+N3J35QZnw9fD1QjLeHTxFJJRAHCfJy6awbu42zTgvNuTDdpj+60GN0EqbvLtTd5o4ZaXfHJQFzEYPpsU/09Qe1xY6X65aKhib8a+QzGqMsqlIU24cwIFJfr0M8Zw5EwVP3fYMK86WZY+xTJcBEFGq+INChSzaHWnS2PfhoAkwIu4bQN1rHRYkev2M5cD5xxTy1/QxEKYJ7eFw7gUiO4EcU9oc3MQBIFHTnJKEG1mZzDcbXGh0C52hCZbGRtLfD3fhuybK4CHhZPdHcQvUHosvbYIH/1gyB5j5Y3kNAuZqu5CqjoGhUeySubuhQtY0hlLPKFBMi7Lsr+ZPOf1sN7eG0EHXBiCnrTHg83rsjYFb2Gx/ngPNwIrjHSlPhC2bHVTYjhqinvKakMhjDj+3Ud
    X-Microsoft-Exchange-Diagnostics: 1;DM3PR19MB0652;25:2Xop/jan/JK+iAmGWBIxTWVRv4Y/2v5clQ7ZeZntxsjPr512TA/JTYsnp6NZvFRTWkWam/yXM4LLemIFqEOaLBUtP4r3Agys8UeSspkPEDfp/ydLQu7hqg7rXdjKm9ETjtmQKRaw9zojSKkJetUma/Jf7J9RKT6YsTO7YPhnTH8rsyuPJwl/AVr2MDVrnmNKXRaMIF2DfBcOIhvWjxXAIOrx5Q6zSamCod0zqxETgnVItCpmxWesxu+bGfrNGg2Vu2tUTrAvHzsGCokoeQ1K7rz3eizpb3I5lvdGRLBzkRU2J7D26fP54GkQBaRXRxMDb29sGEPUA1tqfPXJ3Zb9AUxsKWvxyO7FWAgB4VhxqBITNn5zI28QsPS+VQv7wnhm0kBoCNC3N9JRgaUG2+iwYKKlBzLpule/tLu5X1d80rWkammHDHlITYHB0OU+GpypMhD1ktJqNd25xZ3DXH1fhw==;31:Q/NfttCKYz7RpVL5xDjitIydKxwTC/icNdv3yrkWqdruV7kdtb4wQbJvAx5XBT0/xwXrUv1Jux5TTNApFBVqc95+TmA3rh9/Ot67KO1ZuHTbfeE25q9z/EGDDN0wbaxjY44nyESc1uyADioK0oRxL6dJl1vmRUuyMV9nZmGITdGbxKFBs4WgeGDc55uFTwYimvuc7rPtxA25OMvLEsEyq0jEsi27B2smDVGlwBTqWRl4TClK9L71fYtG5MoUkfB2sDsPjlCUZqRupFn5bE5PTg==
    X-MS-Exchange-Organization-AVStamp-Service: 1.0
    X-Microsoft-Exchange-Diagnostics: 1;DM3PR19MB0652;20:hmss0tdFvUs9uZWVrq6qqL8H3htZl/Q9aMCBUV6OzyBj00yd3o8iIEL+qiZlPrPQTPFTPxO9LXYQVPo9GEdtwzE8Gc7ZRIW+sq4D9lY6IgknhC3zN954O9I8PRhggSGN541Tkg3C/nQJnLtpXTt0lprCjK2vVKFSH7C1l2uNn939bGXRlSj1aQzJpkBECmo1rjrqX3mWPw5qYy72AswmPatpj274myV+s2L2mPF6V3bGYcgAmoWquhau4+UXE0xqnFNwlDpOpol4+7cTX35zQokrvJj5XYD/OMH09WkvRzOJEQFDyci8buf21AziCSPrH4fE5QFP4SEaDrJW6z1XEqsPAhHKHboRR6LQXNhstxBRXVeCoxFUmBrALKu9b1uqYTLQyiKYGQHE7og8iUajG2Daf98qtSLswsDxzLyNc136BZo6PQ2tIGveZW1FSrrzPvE7WNJ1i7ZOM/Nji4Y2a3IRJJpjSDblIN0pA2Sw1MEnY247toq1BG8Z69lSkdZm
    X-Exchange-Antispam-Report-Test: UriScan:;
    X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(9101531078)(601004)(2401047)(13016025)(920008026)(13018025)(8121501046)(9101536074)(10201501046)(3002001);SRVR:DM3PR19MB0652;BCL:0;PCL:0;RULEID:;SRVR:DM3PR19MB0652;
    X-Microsoft-Exchange-Diagnostics: 1;DM3PR19MB0652;4:AikOqI3jL51aQ9KgMynhnpNLC4G5TcMjaiIMS4jTKp2fMhcjuy0wRPbkoc4jWEscgALW5LtAWOKuSH30XmiEL0pHP99AKJb+JNHu3y+oYIkXQR+rYt0aPT4fHTO1d/JDGiqiDvBwA8a80byd0xlxT0MmjFATnlsCNQhar83ahKEAEiuekb7zNNBfkTWa9fhGsKaa6faLwWAPcjYCqDhsmLAiX3M0ws258vtko+xvR92nilpaIVJDzMF/MBEkT1/THVqk4kGNkgfvnjP4/zI1RfnqndXU51lmzobv59lgFDdgtDlTsTYuk5g9eQidtk0GG3KpxE6LOGDFNhjy7zr3xbf6O3ewwI4skMMq96F+U3yxc1OexRfvpjM71oiX2IC5zcypZOJdUZBGJSznsC2SIB2n2kn/7oBTM99WOZgtbSeDBzGac/kg4RyWINIIwFYi01zrY5gW+i1FeAttZ/IYSKL2GGcoHTMtjpJAG3Ga+2Q=
    X-MS-Exchange-Organization-SCL: 5
    X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;DM3PR19MB0652;23:B/DCNE12OP3oKAjOf1EbrsWTiAytHvyc0RQKk9OO0?=
     =?us-ascii?Q?2XTbZnOXf67E2cE0STSaDvTjjx70r+vHQo/OJu9gw/uhLiy47+08k/oDEO8x?=
     =?us-ascii?Q?O4Bu9ewZKJAJPXyJinu1rknt0irejBpXlMSag1YMh9GeFdDmjhAiu3IFbyYX?=
     =?us-ascii?Q?SHS8l8JGN4c8ID2Bj0EAWe8Byy6hW9yV3U4zET4Tf5Y6uXgSYcTP3WAOsgLr?=
     =?us-ascii?Q?fNuBrGA3TjnKU8KXb/R74blQ4JO0jqa89nSBjlWQbFuhFjHlKo2Dfmd5DXdA?=
     =?us-ascii?Q?NTQJryJsFs21LcFu+NuoBOUelexe8q/2LKyky/Cb5dXRlIdx5JUC1e3WZQmu?=
     =?us-ascii?Q?BXPHbHnHfeYO+j8FGdjEYDc78NECd9ExlCkRzLAq5wW0krFdCF2ORmEZ0v8S?=
     =?us-ascii?Q?m2Qa5ATEnhrhBv/ezUMnKfhkuA6qJVC0Gwo+GdLZpuhqeB3KcUgzYajP9hV+?=
     =?us-ascii?Q?w1w7jvBOPbCd1jzlUu0GmZLPJKumHDQImZeXdH/960f55ekOcUqOClYYAxn+?=
     =?us-ascii?Q?d0vv83bWG8sHtJxnwZoyaN2drituNTyjxvDwZjPn9m5ymthww4jTCinW7bbS?=
     =?us-ascii?Q?ZnFCL2D9w2kypdD5p5IFM6scp8s+/WLYF8qO47M0kn9hM/AADRg0qOHslX5A?=
     =?us-ascii?Q?FNpI8WH2LuS5L6UYvWEaKju/bFxE+qBj+Is6hFwcO9PBM7au47WmHuul2CSn?=
     =?us-ascii?Q?Nug00/cHZlQdOoBCD+tkJuZBYt3pDI7a/cZN1vnUUcIZK1D7PEKrIJrRluRS?=
     =?us-ascii?Q?n+hyPwsAVuIJisfgKBvLwYiv/gTxZa5DTWFqBuYSeon67fvGB1hlPdwLJMi+?=
     =?us-ascii?Q?VXEsNSptuaHM7sPokMU2d/JJbf2o9ueLECvz3qh/OHWdyL2FVVzlmvQS/e6o?=
     =?us-ascii?Q?Z1vZvVc3Mr4/O80szYvGAAI7uWsjS3Nf4sDUfbwXGa9yUdQDw/5Eo39e9+46?=
     =?us-ascii?Q?RSzuPqozuaQDWUvb4527/TuAw+YM77Gb4Nl2wI6jpy7Pf867Pt8N3BjqwyG8?=
     =?us-ascii?Q?zRku8S4UDiCdr2xTqdVmsuM8wvxe3SCFnQuHJhGxdXfa6qPzjvksHOY+aun4?=
     =?us-ascii?Q?IGkdzeWMDDsyWxQqGJbxkWYQCmT8YIwIGO4o44IdeuiQ2gpzXLuWvSxNcB2i?=
     =?us-ascii?Q?Hf+d+arx902+SmH/ZgQ++SmnEGgJRyIjQL0IUp04PmaUcmGW4Q7jw5arDwb+?=
     =?us-ascii?Q?NKjnkF9v8VX0604U5Ko0cBdlbZOXBLpf37smJUhZb2fkXwaxi+4znC+XO9WD?=
     =?us-ascii?Q?+/+Ed1ayA4zDOe2t5A84wDzgfyYhR4BNZMqMSBmgM2mKVWV+U8xDOaRb67Zl?=
     =?us-ascii?Q?vASNZlLgA/QQJsKVIFpb+O6fx5kxbye1rFTEm8zfPVDzfE0/SRlp1WQykTR3?=
     =?us-ascii?Q?m3Xnsn8fm+uDJH0uzEfzzfGnBUrBedyVJHx03JK+B3oAkJAHyb3v6NcGWS3m?=
     =?us-ascii?Q?gXbngYqCA=3D=3D?=
    X-Microsoft-Exchange-Diagnostics: 1;DM3PR19MB0652;6:7HMAnJzaKLhK3KNxkYdaiq8AwAIXl7cfZI1fq5PmnLu3ys6vmm/f83+AVdP/Vm6gAifQIk9VbeHPRLzc7lCRlwOzxvHEuW2ZTM8pN8DPHKI6lqrBDFydMF97rqq5VVvwB/B02Gh417fnN1FoSvQRx55i+/g/hHg2REXhHJ7ysWr2zn0kb8vp8eXLLd00FpMJP8eA3tDAgAhIid74lbqy48f7AF7VZGxBQK4B8qFuV4DMljpIAod8hYSHqwaDwf2SADT1AHQ42DLgmnWetR+1vQpFwuKngt4iZ/2J2LVsmp2Vsa/cnROFshsyG9WCuZfeyATVF6WIpoDfpi2KNbCB0JrhKCPiaaejiaCN8Hfssi+TNdG/M34dbm2rro+zj7/a99QfwcmAr70+W0HFY03Avb/2ZTWKoa6n/4afyFUS+flpEkzy6/r5F9nZWqKN/mGXolRtRKx5r9mtEvYegl+R1J0NsgvQ299rzJACqg3jI+lGB9wthAQ/6EBvPTHsfP7B;5:UdiY1gOO44dD0472V4eIv5M6KbAChteBs80P9Wr5WhDaDoRkuJE0eyF1peWs5GXsnrYYK+vNqNMpY56Jpp+A7hjVcSHdW6pq87LAlClZHSCVdq78/GDWaGNnYmjX8n9WRrVIaa18z5cckemmyYlYfBrSVvFM8uEQPxmtml1Dlis=;24:1mNvrJOSTOLUI5vnUP+CiH/3XSuJJyYe0mi4W2NNiBDTAKVDllxRW3nX6xJAOhrfixE3PG/KuRCiRa+jTgCKsw==
    SpamDiagnosticOutput: 1:22
    SpamDiagnosticMetadata: NDR+BackScatter+Testing
    X-Microsoft-Exchange-Diagnostics: 1;DM3PR19MB0652;7:O9+fBfWwcgyQOUJPM66ApDjr2lcClT/heXr+jKz4zxW0BERlfDoU898yH94GWpX8Xx0YRPFgGKpyqykPGpdN6R0zaTtnDVcdEBF0+7eX7aCoRsprOKIMl3nZxOU5+QqG6p65zIqBtVGZnubz3xjm50GZ56YAVvwacdxhzdo5giBI/lUoKDUHXD0hMH4OLTT2n19ChS12wcESyTpf4aSsHss92DJL4ESsN63OzLwAIyO31p7BPSuT88vKeaasoI2HiEv+HTGVAXdV7vpwmej/89cGdLyaZjZDSt74bpT2BGG774WrJ8wRDiWnTzC4tPElyAseJdqOo4nC2UjA0SLqYXn6ELXYVYzSOa1bcQE6tG2zTS+dWlZH1F6+/ffVAedosyWBh4RATjOVzkclJ0KXay0oTvGmjUVS+w40QkC9DN2goBdIPshQTfb9Qc6DagqIhFts0dqNheHYQOT6MeE2YA==
    X-Auto-Response-Suppress: DR, OOF, AutoReply
    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Mar 2017 23:11:47.3777
     (UTC)
    X-MS-Exchange-CrossTenant-Id: f7d95f28-fa3e-4ffa-be97-555a86a2d8a7
    X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM3PR19MB0652
    X-Microsoft-Exchange-Diagnostics: 1;DM5PR19MB1067;23:NfgYM0hdOTKuhRQ9ovfSD7HLMNSh5cc755r+0Yks9d7ft+m2ujilnOV+kmgLzwB8plS0dCEAWxJNlfYiKGFPemsbQddGNZdGZYQugUelJ0OfrdIlX87iedQx0Uav6yqSBwWiCWmbGi+pxmvtiAjI9s8lTz68SUYiSyMyp7Thl6HcMqQb4X4PrbUjcHpWYcKf
    X-MS-Exchange-Organization-AuthSource: BN1AFFO11FD045.protection.gbl
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.2919829
    X-Microsoft-Exchange-Diagnostics:
     1;CY4PR19MB1062;9:cdffMKx8kPrB7slyE07jdodwTquNNb8BEWb9QFBta/cKMGClwsU1Ap0pyNV3x7w7gvIvylEVlklW+lVcJb/dJh+bn2IrqpVh9qFH6W9cP6sEa+KHPYByO14pCcDLS0SARGXFVJJmnyGq8yS7uokvwF5ATD44wdoPI1aMZzNk6sfyHlCyWr/ngpcIqGcHnmEOAdF3ULoEyZMmBwHM0Ypx8ppUCvU78h+6Wi5lYkzvK0U=
    X-Microsoft-Exchange-Diagnostics:
     1;CY4PR19MB1062;27:VGi73quDIuwd2JQbAJH/Ao2V2qs6JVXFs0At7/Y9rBDZMxvonBSSWKQ3cLQZPW9uTeWJg+eu//irvaMbDrHevHmkwTDgN3BI9f7RiyGqZ8WeyvvnjcW+xEDd3pwlAnzRIXfPNmgBReWeoYXLEquM4w==

    Saturday, March 11, 2017 12:21 AM

All replies

  • Hi,

    Can u review your rules.... Is that "STOP PROCESSING MORE RULES"  enabled ??


    • Edited by Hardik_Patel_ Sunday, March 12, 2017 4:55 AM instate of rule i mentioned role
    Sunday, March 12, 2017 4:54 AM
  • Hi Extrimity,

    Agree with Hardik, each rule offers the option of stopping processing more rules when the rule is matched, you need to check if the third rule enables this option or not.

    Run the following command to check:

    Get-TransportRule | FL Name, StopRuleProcessing 

    The value of "StopRuleProcessing"  is "True" means enabled.

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, March 13, 2017 6:56 AM
    Moderator
  • Hi,

    Here's the screenshot of the mail flow rule.

    I'll try to enable stop processing rules if that works.



    Monday, March 13, 2017 8:02 PM
  • Hi Extrimity,

    In your case, you should check if the third rule enables "stop processing more rules" option.

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, March 15, 2017 10:05 AM
    Moderator
  • Hi all,

    Sorry for the late response. the stop processing options seems to have no effect. the SFV: SPM and SCL: 5 Rules are still being ignored.

    Any thoughts on this?

    Thank you

    Thursday, March 16, 2017 8:09 PM
  • Hi Extrimity,

    Which rule did you enable the stop processing option? for further troubleshooting, I recommend you run the following command and post the result:

    Get-TransportRule | FL Name,State,Description,StopRuleProcessing,*Date 
    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, March 17, 2017 3:21 AM
    Moderator
  • Hi here's the result.

    Name               : *SPAM WARNING* - Spam Filter Value
    State              : Enabled
    Description        : If the message:
                             'X-Forefront-Antispam-Report' header contains ''SFV:SPM''
                         Take the following actions:
                             Prepend the subject with '*SPAM WARNING* '
                         Except if the message:
                             Is received from 'example1.com'
                             or sender's address domain portion belongs to any of these domains: 'intuit.com' or
                         'example.com'

    StopRuleProcessing : True
    ActivationDate     :
    ExpiryDate         :


    Monday, March 20, 2017 8:09 PM
  • Hi Extrimity,

    I suppose this would be a transport rule priority issue. When a message applies to three transport rules at the same time ,the rule with a priority of 0 will be processed only.

    You can disable any two rules as a test and check if the last enabled rule works as expected.

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, March 21, 2017 2:42 AM
    Moderator