Today we encounter a new issue, a user was complaining about receiving a lot of spam in their inbox. He sent me more than ten examples and when looking at the header, all of them were well identified by EOP and should have been moved to the Junk email folder…

X-Forefront-Antispam-Report: CIP:;CTRY:DE;IPV:NLI;EFV:NLI;SFV:SPM;SFS:(2990300002)(438002)(3380300002)(189002)(199003)(107886002)(106466001)(58226001)(2351001)(77156002)(19617315012)(46102003)(81156007)(16236675004)(62966003)(15975445007)(512874002)(450100001)(5002240100001)(84326002)(2920100001)(64706001)(229853001)(4001450100002)(5001960100002)(2160300002)(110136002)(92566002)(5001860100001)(5001830100001)(81686999)(50986999)(4001540100001)(5002050100002)(54356999)(42186005)(19580395003)(189998001)(44706002)(86362001)(87836001)(100156002);DIR:INB;SFP:;SCL:5;SRVR:DB3PR06MB140;H:7ibe5o3.bilti.faith;FPR:;SPF:Pass;PTR:7ibe5o3.bilti.faith;MX:1;A:1;LANG:en;

I have also performed a mail trace and it was explicit that the email has been moved to the junk email folder !


After some search, I found that there is a possiblity to disable and also custom the junk email rule for a specific mailbox. This can be done thanks to this command Set-MailboxJunkEmailConfiguration (https://technet.microsoft.com/en-us/library/Dd979780(v=EXCHG.150).aspx).

After running the command Get-MailboxJunkEmailConfiguration for this user, I have effectively seen that for him the rule was disabled ! Why this was disabled, I don’t really know but I think that this was done before the migration to O365 and this setting is kept during the move.