Documentation Home > Exchange Anti-Spam Toolkit
Content Filter
The Content Filter allows Exchange to filter spam through analysis of the message content. Apart from lists of Allowed and Blocked Phrases, the Content Filter allows specific senders and recipients to be white-listed, which causes messages to be bypassed by the Content Filter.
The lists of Allowed Senders and Allowed Sender Domains are also used by the QSS Sender Score Agent (if enabled) to allow certain senders to bypass Sender Score filtering, even if the Content Filter is not enabled.
Spam Confidence Level (SCL) Values
The Content Filter assigns a Spam Confidence Level (SCL) to messages, based on its analysis. The higher the SCL value, the more likely the message is to be spam. This SCL value can be used to Reject, Delete or Quarantine messages based on configurable thresholds.
The Content Filter can also be used to filter messages into a user's Junk Email folder, based on the SCL Junk Threshold value configured for each mailbox in Mailbox Junk Config.
SCL Values are stored to the X-MS-Exchange-Organization-SCL header and can be inspected by viewing the message headers in Outlook or Outlook Web App.
The assigned SCL value is also available to Transport Rules to enable custom processing. In this manner, custom rules can be created where the SCL is combined with other message characteristics to take actions such as rejecting or moving messages. SCL values can also be overridden by Transport Rules.
Important Note Regarding Microsoft SmartScreen & Spam Definition Updates
The Content Filter in Exchange was originally designed to use SmartScreen filter technology and regular spam definition updates provided by Microsoft.
Microsoft discontinued spam definition updates for the SmartScreen filters in Exchange and Outlook in November 2016. While the outdated definitions can still be used, this diminishes the reliability of the message analysis performed by the Content Filter.
It should be noted that even before the definition updates were discontinued, message content analysis in practice was less reliable and less useful than other types of filtering (such as the Connection Filter, URL Filter and Sender Score). It is much more prone to false positives than other filtering mechanisms.
As a result, it is recommended that the Content Filter be used with caution. Enabling the Content Filter without enabling the Reject, Delete or Quarantine actions is recommended. The Allowed and Blocked Phrases lists can be useful in some situations, and the Content Filter is useful when used to simply move messages with a high SCL value to the Junk Email folder, which may have passed through other filters. We do not recommend enabling the Delete or Reject actions due to the high risk of false positives.
Content Filter Actions
SCL Reject, Delete & Quarantine Thresholds
If the appropriate settings SCL Reject Enabled, SCL Delete Enabled and SCL Quarantine Enabled are turned on, the action will be taken when the SCL value of a message is greater than or equal to the specified SCL value.
Outlook Email Postmark Validation
The Postmark header was introduced in Outlook 2007, but it has been removed in Outlook 2010 and above. If this is enabled, the Content Filter will analyze such a header (if present) and use it as part of the SCL calculation.
Rejection Response
If SCL Reject Enabled is turned on, the Rejection Response will be returned with an error code in the SMTP session.
Allowed Recipients
Messages sent to Recipient (internal) addresses added to this list will bypass Content Filtering. Other anti-spam filters and processing will still run on those messages.
Allowed Senders
Both Allowed Senders and Allowed Sender Domains can be specified, which will cause messages from those senders to bypass Content Filtering. Other anti-spam filters and processing will still run on those messages.
Blocked Phrases
Messages which match the phrases defined on this list will be assigned an SCL value of 9 and will be processed accordingly. Note that if the SCL Reject Enabled action turned off, messages with Blocked Phrases will not be automatically rejected, however they can still be moved to the Junk Email folder.
Allowed Phrases
Messages which match the phrases defined on this list will be assigned an SCL value of 0 and will be processed accordingly.