IMF Tune - Bringing Back the Exchange Connection Filter
SafeSenders, BlockedSenders and the Mystery of Misclassified Emails
If you are looking for an article full of suspense I am sorry to disappoint you. The heading gives away the entire plot. The story is about misclassified emails and the culprits have already been identified to be the Outlook SafeSenders and BlockedSenders lists.
This is one of those stories that have been recounted several times. Everyone seems to know it, and yet many are still caught unprepared. Supporting IMF Tune, with its tight Exchange anti-spam integration, I often end up troubleshooting Exchange problems to prove that our product is working fine. So I find myself in the perfect position to regularly rescue those who forget of this trap.
The story always concerns incoming emails. Sometimes a legitimate email is always getting blocked. Other times it's a spam email that seems unstoppable getting delivered to the user Inbox. Very often the problem affects one user (the boss of course) but it could also concern multiple or all user mailboxes.
What makes this problem elusive is that pretty much everyone today uses server-side spam filtering (whether on-premises or cloud). Administrators often think that they are in complete control of the filter configuration. After all, aren't they the only ones to access the server configuration?
We have a video series on the various server-side spam filters available in Exchange out-of-the-box. The videos cover the configuration tasks Exchange administrators perform when managing these filters. Unfortunately even these videos overlook the sneaky Outlook sender lists.
Note: The videos were produced for Exchange 2013 but are largely applicable to all Exchange versions from 2007 up to 2016. Check them for a tour of the anti-spam features readily available in Exchange.
Getting back to our problem scenario, consider a legitimate email getting blocked with a
Stopping the Sender ID filter makes no difference. So what can it be, given the very clear rejection response?
This is when we should check the Outlook sender lists. Outlook lists are the window for users to customize their spam filtering directly. These settings are taken up by transport servers and are enforced together with all other server-side anti-spam settings.
Before Exchange 2010 managing these settings wasn't easy. We had to login as the user and change the settings from Outlook/OWA, or else we could use complex scripts.
However the situation improved significantly as from Exchange 2010 with the introduction of the lifesaving
Working with MailboxJunkEmailConfiguration
To see the sender lists for a user mailbox:
We can use the usual list manipulation syntax to modify these lists. Clearing the blocked senders list is done by setting it to
To completely replace all the list entries:
Here I am clearing all
To add new addresses to the current
To only remove specific entries from the
Configuring Multiple Mailboxes
If we wanted to modify multiple user mailboxes we would pipe the result of Get-Mailbox into Set-MailboxJunkEmailConfiguration.
For example here I am clearing all sender lists on all mailboxes for the specified Mailbox Database:
When dealing with multiple mailboxes it's best to include the
Running cmdlets on multiple mailboxes is most useful when clearing lists or removing problematic addresses. Adding addresses to all user lists is less useful. Addresses that should be blocked/accepted by all users should go to the server configuration whenever possible.
More MailboxJunkEmailConfiguration Options
Apart for the sender lists let me also highlight some other important
Other configuration options to be aware of include the
On the other hand
So these options also have a significant impact on how emails are filtered. Indeed these can be trickier to pinpoint than an explicit