I have a client who has multiple sites. Their exchange server receives "scan to email" emails from a Canon C2020 Digital Multifunction on a different site. To stop the Exchange 2013 Spam filter blocking the emails, I set up a Transport Rule.
The rule has the following properties
- If the Sender Address matches canon.device@gmail.com
- Set the SCL to 3
- Generate an incident report and email to the system admin, and inlcude the original email
- Is the 3rd of 3 rules (the prior 2 add Disclaimers to outgoing emails depending on who the sender is)
Simple enough right.
Wrong - some staff scan to email repeatedly and the scan arrives ok in their inbox. Others, it simply will not let the email thru, and instead places the email into the Spam Mailbox. I open the blocked email, click on Send Again and it arrives for the user.
Is the Transport Rule functionality buggy or prone to odd behaviour. I have sat and read through the Rule so many times it is tattooed onto my retina.
The Email addresses for all users are created by an Email address policy so all are a consistent format = Firstname + Surname 1st Initial@contoso .com.
There have been times where I have wondered if the rules are case sensitive when assessing the email addresses.
Any thoughts to put me out of my misery, please show me where I have done wrong....
Get-TransportRule returns
[PS] C:\Windows\system32>Get-TransportRule "[Cust-sos-IN] Reset SCL on Scanner emails" | Format-List
RunspaceId : 7f9c4f6e-7d35-409e-acf9-cbb272720b8c
Priority : 2
DlpPolicy :
DlpPolicyId : 00000000-0000-0000-0000-000000000000
Comments :
ManuallyModified : False
ActivationDate :
ExpiryDate :
Description : If the message:
Is sent to 'Accounts@contoso.com' or
'Administration@contoso.com' or'Allan@contoso.com' or
'FredaM@contoso.com' or
'Client.Services.Manager@contoso.com' or
'DonnyY@contoso.com' or
'ElenB@contoso.com'or...
and Includes these patterns in the From address:
'canon.device@gmail.com'
Take the following actions:
Set the spam confidence level (SCL) to '3'
and Send the incident report to SharonK@contoso.com, Include
original mail
RuleVersion : 15.0.2.0
Conditions : {SentTo, FromAddressMatches}
Exceptions :
Actions : {SetSCL, GenerateIncidentReport}
State : Enabled
Mode : Enforce
RuleSubType : None
UseLegacyRegex : False
From :
FromMemberOf :
FromScope :
SentTo :{Accounts@contoso.com,
Administration@contoso.com,
AmandaC@contoso.com,
AshleyM@contoso.com,
Client.Services.Manager@contoso.com,DonnaY@contoso.com,
EbonieB@contoso.com,
FranR@contoso.com, Intake@contoso.com,
JoP@contoso.com,
LenoreL@contoso.com, MarinaL@contoso.com,
NatashaS@contoso.com,
NiamhS@contoso.com, UnaG@contoso.com,
Helpdesk@Acontoso.com...}
SentToMemberOf :
SentToScope :
BetweenMemberOf1 :
BetweenMemberOf2 :
ManagerAddresses :
ManagerForEvaluatedUser :
SenderManagementRelationship :
ADComparisonAttribute :
ADComparisonOperator :
SenderADAttributeContainsWords :
SenderADAttributeMatchesPatterns :
RecipientADAttributeContainsWords :
RecipientADAttributeMatchesPatterns :
AnyOfToHeader :
AnyOfToHeaderMemberOf :
AnyOfCcHeader :
AnyOfCcHeaderMemberOf :
AnyOfToCcHeader :
AnyOfToCcHeaderMemberOf :
HasClassification :
HasNoClassification : False
SubjectContainsWords :
SubjectOrBodyContainsWords :
HeaderContainsMessageHeader :
HeaderContainsWords :
FromAddressContainsWords :
SubjectMatchesPatterns :
SubjectOrBodyMatchesPatterns :
HeaderMatchesMessageHeader :
HeaderMatchesPatterns :
FromAddressMatchesPatterns :{canon.sos@gmail.com}
AttachmentNameMatchesPatterns :
AttachmentExtensionMatchesWords :
HasSenderOverride : False
MessageContainsDataClassifications :
SenderIpRanges :
SCLOver :
AttachmentSizeOver :
MessageSizeOver :
WithImportance :
MessageTypeMatches :
RecipientAddressContainsWords :
RecipientAddressMatchesPatterns :
SenderInRecipientList :
RecipientInSenderList :
AttachmentContainsWords :
AttachmentMatchesPatterns :
AttachmentIsUnsupported : False
AttachmentProcessingLimitExceeded : False
AttachmentHasExecutableContent : False
AnyOfRecipientAddressContainsWords :
AnyOfRecipientAddressMatchesPatterns :
ExceptIfFrom :
ExceptIfFromMemberOf :
ExceptIfFromScope :
ExceptIfSentTo :
ExceptIfSentToMemberOf :
ExceptIfSentToScope :
ExceptIfBetweenMemberOf1 :
ExceptIfBetweenMemberOf2 :
ExceptIfManagerAddresses :
ExceptIfManagerForEvaluatedUser :
ExceptIfSenderManagementRelationship :
ExceptIfADComparisonAttribute :
ExceptIfADComparisonOperator :
ExceptIfSenderADAttributeContainsWords :
ExceptIfSenderADAttributeMatchesPatterns :
ExceptIfRecipientADAttributeContainsWords :
ExceptIfRecipientADAttributeMatchesPatterns :
ExceptIfAnyOfToHeader :
ExceptIfAnyOfToHeaderMemberOf :
ExceptIfAnyOfCcHeader :
ExceptIfAnyOfCcHeaderMemberOf :
ExceptIfAnyOfToCcHeader :
ExceptIfAnyOfToCcHeaderMemberOf :
ExceptIfHasClassification :
ExceptIfHasNoClassification : False
ExceptIfSubjectContainsWords :
ExceptIfSubjectOrBodyContainsWords :
ExceptIfHeaderContainsMessageHeader :
ExceptIfHeaderContainsWords :
ExceptIfFromAddressContainsWords :
ExceptIfSubjectMatchesPatterns :
ExceptIfSubjectOrBodyMatchesPatterns :
ExceptIfHeaderMatchesMessageHeader :
ExceptIfHeaderMatchesPatterns :
ExceptIfFromAddressMatchesPatterns :
ExceptIfAttachmentNameMatchesPatterns :
ExceptIfAttachmentExtensionMatchesWords :
ExceptIfSCLOver :
ExceptIfAttachmentSizeOver :
ExceptIfMessageSizeOver :
ExceptIfWithImportance :
ExceptIfMessageTypeMatches :
ExceptIfRecipientAddressContainsWords :
ExceptIfRecipientAddressMatchesPatterns :
ExceptIfSenderInRecipientList :
ExceptIfRecipientInSenderList :
ExceptIfAttachmentContainsWords :
ExceptIfAttachmentMatchesPatterns :
ExceptIfAttachmentIsUnsupported : False
ExceptIfAttachmentProcessingLimitExceeded : False
ExceptIfAttachmentHasExecutableContent : False
ExceptIfAnyOfRecipientAddressContainsWords :
ExceptIfAnyOfRecipientAddressMatchesPatterns :
ExceptIfHasSenderOverride : False
ExceptIfMessageContainsDataClassifications :
ExceptIfSenderIpRanges :
PrependSubject :
SetAuditSeverity :
ApplyClassification :
ApplyHtmlDisclaimerLocation :
ApplyHtmlDisclaimerText :
ApplyHtmlDisclaimerFallbackAction :
ApplyRightsProtectionTemplate :
SetSCL : 3
SetHeaderName :
SetHeaderValue :
RemoveHeader :
AddToRecipients :
CopyTo :
BlindCopyTo :
AddManagerAsRecipientType :
ModerateMessageByUser :
ModerateMessageByManager : False
RedirectMessageTo :
RejectMessageEnhancedStatusCode :
RejectMessageReasonText :
DeleteMessage : False
Disconnect : False
Quarantine : False
SmtpRejectMessageRejectText :
SmtpRejectMessageRejectStatusCode :
LogEventText :
StopRuleProcessing : False
SenderNotificationType :
GenerateIncidentReport :SharonK@contoso.com
IncidentReportOriginalMail : IncludeOriginalMail
RouteMessageOutboundConnector :
RouteMessageOutboundRequireTls : False
Identity : [Cust-sos-IN] Reset SCL on Scanner
emails
DistinguishedName : CN=[Cust-sos-IN] Reset SCL on Scanner
emails,CN=TransportVersioned,CN=Rules,CN=Transport
Settings,CN=Contoso,CN=Microsoft
Exchange,CN=Services,CN=Configuration,DC=CONTOSO,DC=LOCAL
Guid : 5d1dbc9b-3718-4874-9552-296e8b98d874
ImmutableId : 5d1dbc9b-3718-4874-9552-296e8b98d874
OrganizationId :
Name : [Cust-sos-IN]
Reset SCL on Scanner emails
IsValid : True
WhenChanged : 17/03/2015 2:37:06 PM
ExchangeVersion : 0.1 (8.0.535.0)
ObjectState : Unchanged