I have an SBS 2008 box running Exchange 2007. Mail is delivered directly to the Exchange machine from the Internet via a receive connector (I have already advised people that it would be better to use a smarthost...)
I've configured Content Filtering to reject anything over an SCL of 6. Deleting and quarantining options are disabled. SCLJunkThreshold is set to 5.
There are a couple of users who are seeing mail delivered to their inboxes despite the headers clearly having the X-Ms-Exchange-Organization-Scl attribute set to a value higher than either threshold. e.g. 8
Looking at Message Tracking shows that the ReceipientStatus is "550 5.7.1 Message rejected as spam by Content Filtering." as expected. However, there is then a DELIVER event from STOREDRIVER which I assume is where the message is placed in to the mailbox.
I suppose my first question is have I misunderstood how rejection is applied? i.e. is this purely treatment of the sender by sending them a notification rather than discarding the message internally. If not, any ideas as to why Exchange is still delivering messages that are clearly spam?
Many thanks,
Mike
