Inconsistent Results from Transport Rule to reset SCL

I have a client who has multiple sites. Their exchange server receives "scan to email" emails from a Canon C2020 Digital Multifunction on a different site. To stop the Exchange 2013 Spam filter blocking the emails, I set up a Transport Rule.

The rule has the following properties

  1. If the Sender Address matches canon.device@gmail.com
  2. Set the SCL to 3
  3. Generate an incident report and email to the system admin, and inlcude the original email
  4. Is the 3rd of 3 rules (the prior 2 add Disclaimers to outgoing emails depending on who the sender is)

Simple enough right.

Wrong - some staff scan to email repeatedly and the scan arrives ok in their inbox.  Others, it simply will not let the email thru, and instead places the email into the Spam Mailbox.  I open the blocked email, click on Send Again and it arrives for the user.

Is the Transport Rule functionality buggy or prone to odd behaviour.  I have sat and read through the Rule so many times it is tattooed onto my retina.

The Email addresses for all users are created by an Email address policy so all are a consistent format = Firstname + Surname 1st Initial@contoso .com.

There have been times where I have wondered if the rules are case sensitive when assessing the email addresses.

Any thoughts to put me out of my misery, please show me where I have done wrong....

Get-TransportRule returns

[PS] C:\Windows\system32>Get-TransportRule "[Cust-sos-IN] Reset SCL on Scanner emails" | Format-List


RunspaceId                                   : 7f9c4f6e-7d35-409e-acf9-cbb272720b8c
Priority                                     : 2
DlpPolicy                                    :
DlpPolicyId                                  : 00000000-0000-0000-0000-000000000000
Comments                                     :
ManuallyModified                             : False
ActivationDate                               :
ExpiryDate                                   :
Description                                  : If the message:
                                                   Is sent to 'Accounts@contoso.com' or
                                               'Administration@contoso.com' or 'Allan@contoso.com' or
                                               'FredaM@contoso.com' or 'Client.Services.Manager@contoso.com' or
                                               'DonnyY@contoso.com' or 'ElenB@contoso.com'or...
                                                   and Includes these patterns in the From address:
                                               'canon.device@gmail.com'
                                               Take the following actions:
                                                   Set the spam confidence level (SCL) to '3'
                                                   and Send the incident report to SharonK@contoso.com, Include
                                               original mail

RuleVersion                                  : 15.0.2.0
Conditions                                   : {SentTo, FromAddressMatches}
Exceptions                                   :
Actions                                      : {SetSCL, GenerateIncidentReport}
State                                        : Enabled
Mode                                         : Enforce
RuleSubType                                  : None
UseLegacyRegex                               : False
From                                         :
FromMemberOf                                 :
FromScope                                    :
SentTo                                       : {Accounts@contoso.com, Administration@contoso.com,
                                               AmandaC@contoso.com, AshleyM@contoso.com,
                                               Client.Services.Manager@contoso.com, DonnaY@contoso.com,
                                               EbonieB@contoso.com, FranR@contoso.com, Intake@contoso.com,
                                               JoP@contoso.com, LenoreL@contoso.com, MarinaL@contoso.com,
                                               NatashaS@contoso.com, NiamhS@contoso.com, UnaG@contoso.com,
                                               Helpdesk@Acontoso.com...}
SentToMemberOf                               :
SentToScope                                  :
BetweenMemberOf1                             :
BetweenMemberOf2                             :
ManagerAddresses                             :
ManagerForEvaluatedUser                      :
SenderManagementRelationship                 :
ADComparisonAttribute                        :
ADComparisonOperator                         :
SenderADAttributeContainsWords               :
SenderADAttributeMatchesPatterns             :
RecipientADAttributeContainsWords            :
RecipientADAttributeMatchesPatterns          :
AnyOfToHeader                                :
AnyOfToHeaderMemberOf                        :
AnyOfCcHeader                                :
AnyOfCcHeaderMemberOf                        :
AnyOfToCcHeader                              :
AnyOfToCcHeaderMemberOf                      :
HasClassification                            :
HasNoClassification                          : False
SubjectContainsWords                         :
SubjectOrBodyContainsWords                   :
HeaderContainsMessageHeader                  :
HeaderContainsWords                          :
FromAddressContainsWords                     :
SubjectMatchesPatterns                       :
SubjectOrBodyMatchesPatterns                 :
HeaderMatchesMessageHeader                   :
HeaderMatchesPatterns                        :
FromAddressMatchesPatterns                   : {canon.sos@gmail.com}
AttachmentNameMatchesPatterns                :
AttachmentExtensionMatchesWords              :
HasSenderOverride                            : False
MessageContainsDataClassifications           :
SenderIpRanges                               :
SCLOver                                      :
AttachmentSizeOver                           :
MessageSizeOver                              :
WithImportance                               :
MessageTypeMatches                           :
RecipientAddressContainsWords                :
RecipientAddressMatchesPatterns              :
SenderInRecipientList                        :
RecipientInSenderList                        :
AttachmentContainsWords                      :
AttachmentMatchesPatterns                    :
AttachmentIsUnsupported                      : False
AttachmentProcessingLimitExceeded            : False
AttachmentHasExecutableContent               : False
AnyOfRecipientAddressContainsWords           :
AnyOfRecipientAddressMatchesPatterns         :
ExceptIfFrom                                 :
ExceptIfFromMemberOf                         :
ExceptIfFromScope                            :
ExceptIfSentTo                               :
ExceptIfSentToMemberOf                       :
ExceptIfSentToScope                          :
ExceptIfBetweenMemberOf1                     :
ExceptIfBetweenMemberOf2                     :
ExceptIfManagerAddresses                     :
ExceptIfManagerForEvaluatedUser              :
ExceptIfSenderManagementRelationship         :
ExceptIfADComparisonAttribute                :
ExceptIfADComparisonOperator                 :
ExceptIfSenderADAttributeContainsWords       :
ExceptIfSenderADAttributeMatchesPatterns     :
ExceptIfRecipientADAttributeContainsWords    :
ExceptIfRecipientADAttributeMatchesPatterns  :
ExceptIfAnyOfToHeader                        :
ExceptIfAnyOfToHeaderMemberOf                :
ExceptIfAnyOfCcHeader                        :
ExceptIfAnyOfCcHeaderMemberOf                :
ExceptIfAnyOfToCcHeader                      :
ExceptIfAnyOfToCcHeaderMemberOf              :
ExceptIfHasClassification                    :
ExceptIfHasNoClassification                  : False
ExceptIfSubjectContainsWords                 :
ExceptIfSubjectOrBodyContainsWords           :
ExceptIfHeaderContainsMessageHeader          :
ExceptIfHeaderContainsWords                  :
ExceptIfFromAddressContainsWords             :
ExceptIfSubjectMatchesPatterns               :
ExceptIfSubjectOrBodyMatchesPatterns         :
ExceptIfHeaderMatchesMessageHeader           :
ExceptIfHeaderMatchesPatterns                :
ExceptIfFromAddressMatchesPatterns           :
ExceptIfAttachmentNameMatchesPatterns        :
ExceptIfAttachmentExtensionMatchesWords      :
ExceptIfSCLOver                              :
ExceptIfAttachmentSizeOver                   :
ExceptIfMessageSizeOver                      :
ExceptIfWithImportance                       :
ExceptIfMessageTypeMatches                   :
ExceptIfRecipientAddressContainsWords        :
ExceptIfRecipientAddressMatchesPatterns      :
ExceptIfSenderInRecipientList                :
ExceptIfRecipientInSenderList                :
ExceptIfAttachmentContainsWords              :
ExceptIfAttachmentMatchesPatterns            :
ExceptIfAttachmentIsUnsupported              : False
ExceptIfAttachmentProcessingLimitExceeded    : False
ExceptIfAttachmentHasExecutableContent       : False
ExceptIfAnyOfRecipientAddressContainsWords   :
ExceptIfAnyOfRecipientAddressMatchesPatterns :
ExceptIfHasSenderOverride                    : False
ExceptIfMessageContainsDataClassifications   :
ExceptIfSenderIpRanges                       :
PrependSubject                               :
SetAuditSeverity                             :
ApplyClassification                          :
ApplyHtmlDisclaimerLocation                  :
ApplyHtmlDisclaimerText                      :
ApplyHtmlDisclaimerFallbackAction            :
ApplyRightsProtectionTemplate                :
SetSCL                                       : 3
SetHeaderName                                :
SetHeaderValue                               :
RemoveHeader                                 :
AddToRecipients                              :
CopyTo                                       :
BlindCopyTo                                  :
AddManagerAsRecipientType                    :
ModerateMessageByUser                        :
ModerateMessageByManager                     : False
RedirectMessageTo                            :
RejectMessageEnhancedStatusCode              :
RejectMessageReasonText                      :
DeleteMessage                                : False
Disconnect                                   : False
Quarantine                                   : False
SmtpRejectMessageRejectText                  :
SmtpRejectMessageRejectStatusCode            :
LogEventText                                 :
StopRuleProcessing                           : False
SenderNotificationType                       :
GenerateIncidentReport                       : SharonK@contoso.com
IncidentReportOriginalMail                   : IncludeOriginalMail
RouteMessageOutboundConnector                :
RouteMessageOutboundRequireTls               : False
Identity                                     : [Cust-sos-IN] Reset SCL on Scanner emails
DistinguishedName                            : CN=[Cust-sos-IN] Reset SCL on Scanner
                                               emails,CN=TransportVersioned,CN=Rules,CN=Transport
                                               Settings,CN=Contoso,CN=Microsoft
                                               Exchange,CN=Services,CN=Configuration,DC=CONTOSO,DC=LOCAL
Guid                                         : 5d1dbc9b-3718-4874-9552-296e8b98d874
ImmutableId                                  : 5d1dbc9b-3718-4874-9552-296e8b98d874
OrganizationId                               :
Name                                         : [Cust-sos-IN] Reset SCL on Scanner emails
IsValid                                      : True
WhenChanged                                  : 17/03/2015 2:37:06 PM
ExchangeVersion                              : 0.1 (8.0.535.0)
ObjectState                                  : Unchanged


  • Edited by MBKITMGR Tuesday, March 17, 2015 4:15 AM
March 17th, 2015 3:42am

Hi MBKITMGR,

Agree with Zammit, you should use the BypassedSenders parameter to specifies the SMTP address values of senders.

After that, the Content Filter agent doesn't process any content filtering for messages received from the addresses listed on this parameter.

Best regards,

Free Windows Admin Tool Kit Click here and download it now
March 18th, 2015 4:30am

Thanks Alexander and Nikko.

I have taken your advice and added the email address to the BypassedSenders. 

Canon chose the email address when they set the device up for my client.  My logic was:

  1. I had considered putting the email address into the BypassedSenders
  2. but was concerned what would happen if the email address became spoofed

I have done this now and will see how it goes. 

March 18th, 2015 5:45pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics