550 5.7.1 Message rejected as spam by Content Filtering

We are running Exchange 2010. I have a couple of users who are not receiving emails due to our content filter. When I check the message tracking log in our Edge Server it points to a 550 5.7.1 Message rejected as spam by Content Filtering. I guess my question
is, how do I check to see what message in that particular email trigger the email as being spam???? Is this possible?

Checking this might help. Body text doesn't allow me to post links yet. Pasted the content over.
While the IMF can be somewhat helpful, it can be a detriment if you as the administrator don’t remember or even realize that it was installed on the server in the first place.  This can be especially troublesome when you have an additional 3rd party
filtering service in place.  If you have IMF installed it essentially means you are double filtering your mail, once at the 3rd party spam filter and once at the Exchange Server. In cases that a 3rd Party Filtering is in place we typically recommend disabling
the IMF feature. This is of course just a recommendation and you should do whatever you feel is best for your network environment.
How Does the IMF Identify Messages as Spam?
When a message reaches an Exchange Server with IMF installed, IMF will evaluate the textual content of the messages and then assign the message a Spam Confidence Level (SCL) rating from 1-9 based on the probability the message is Unsolicited Commercial Email
(UCE).  This rating is then compared to the threshold set under Message Delivery Properties > Intelligent Message Filter in the Exchange System Manager.
How Do I Find Messages in the IMF?
Theoretically the IMF is supposed to place messages that it found as spam in your Outlook Junk Folder. Unfortunately, this doesn’t always tend to be the case.  If you have reports that messages are “missing” on your server and you can’t find them, check
the IMF! To check this service, you will need to make sure that you have the Archiving option enabled. You can view the *Archived folder location here: C:program files[YOUR SERVER]mailroot[SMTP VIRTUAL SERVER]ucearchive.
*To view these archived messages you will need to download and install a 3rd-party tool.  If you have any recommendations regarding these tools, please leave them in the comments below.
Where is IMF installed?
When IMF is installed a new tab is added to the Exchange System Manager. For Exchange 2003, the tab is under Message Delivery > Properties under Global Settings.
There is also a new Intelligent Message Filtering node under Protocols > SMTP – This is where you enable IMF.
For Exchange 2007, it is under Exchange Management Console Server Configuration > Hub Transport > Anti – Spam.

Similar Messages

  • Get error message 5.7.6 Message rejected as spam on outgoing mail

    when i send mail from Thunderbird i get error message
    "An error occurred while sending mail. The mail server responded: 5.7.6 Message rejected as spam (CM).. Please check the message and try again."
    i don't get it all the time and have narrowed it down to the ebay email id in their emails i reply to
    i use optusnet as my mail server,if i send from their web mail it doesn't get rejected. optus support tell me that the email has to go through a thunderbird email server before they get it and that is where it is being rejected ?????
    any help would be appreciated

    Great, more help desk idiots! There are no Thunderbird servers. Thunderbird is software that runs on YOUR computer and connects to your email providers server. The message would be from THEIR server.

  • MESSAGE REJECTED FOR SPAM OR VIRUS CONTENT-----Please Help!!

    I send alot of emails for my business after a while and try to send an email I get this message
    and cant send through Thunderbird,but if I log into my Go Daddy Workspace..I can send the same exact email with no problem. I can receive emails but not send them. then I wait 24 hours or so and its ok. Im also told when people try to email me sometime they get a bounce back.
    How do I fix this problem? what are some solutions?
    thank you in advance!
    "An error occurred while sending mail. The mail server responded: AWHx1o00A4zJs2i01 :: auth :: Message rejected for spam or virus content :: Please include this entire message when contacting support :: v=2.0 cv=eqoBOPVX c=1 sm=1 p=PPS2TQdNAAAA:8 a=RBIhGjJQwpVXbUQ4VpzIqw==:17 a=zewopLiEtFcA:10 a=woXLOls9kE0A:10 a=8nJEP1OIZ-IA:10 a=by1fjShEoaihZ3t8YggA:9 a=wPNLvfGTeEIA:10 a=RBIhGjJQwpVXbUQ4VpzIqw==:117 :: 100.00. Please check the message and try again."

    I suggest you contact godaddy for some support using their mail service.

  • #550 5.7.1 Message rejected due to unacceptable attachments ##

    Hello,
    We have exchange 2007 with Edge subscription.
    We have a user which wanted to send an email to internal recipient, but delivery failed because he received NDR.
    #550 5.7.1 Message rejected due to unacceptable attachments ##
    I have checked and in attachemnt there was zip file (inside zip there were several Pdf files). I saw that such issue was solved in Hotfix Rollup 5, but we already installed this update and also other necessary updates. Also I have checked content filtering
    options and there were no "zip" files.
    P.s Any other messages with attached zip files not being blocked.
    Any ideas why message was blocked and how I can unblock it ?.
    Regards
    Maciej
    Mac

    Hi,
    From your description, the message with a zip attachment is rejected due to unacceptable attachments. In your case, I recommend you follow the steps in the following KB for troubleshooting:
    You receive an NDR message when you send an e-mail message by using an Exchange Server 2007 Edge server
    http://support.microsoft.com/kb/945046
    What's more, here is the latest Service Pack and Rollup for Exchange 2007 for your reference:
    How to Obtain the Latest Service Pack or Update Rollup for Exchange 2007
    http://technet.microsoft.com/en-us/library/ee221180(EXCHG.80).aspx
    Hope it helps.
    Best regards,
    Amy Wang
    TechNet Community Support

  • 550 5.7.1 Message rejected due to content restrictions

    We're using forefront protection for exchange 2010 and every once in a while the Cloudmark anti-spam signatures will block important clients from sending us email. Reporting the emails to [email protected] doesn't always get the issue
    resolved, but when we contact cloudmark directly they tell us to talk to Forefront. However, cloudmark isn't sure exactly how we're supposed to engage forefront on this type of matter.
    What phone number or email address can we use to handle these requests without an additional charge?

    I too am getting this response from a supplier in UT - I am in UK see message copied below:
    You suggest contact support - who's cost will this be I am a purchaser and the site I wish to contact is the supplier (I am also using my personal e-mail address for this activity)
    Reason for multi addresses are because I have had a result from them on other occassions not all I have gone bust - seemingly....
    I wonder if they are using Outlook 2010?????????????  -  I use 2007 on win 7 no problems till using this site...
    From: System
    Administrator
    Sent: Tuesday, May 04, 2010 11:48 AM
    To: Colin Mason
    Cc: '[email protected]'; '[email protected]'
    Subject: Undeliverable: URGENT ATTENTION IS REQUIRED!
    Your message did not reach some or all of the intended recipients.
    Subject:    URGENT ATTENTION IS REQUIRED!
    Sent: 04-May-10 11:48 AM
    The following recipient(s) cannot be reached:
    'Jessica Blair' on 04-May-10 11:48 AM
    550 5.7.1 Message content rejected <c2c672707936339ea5c92f03ada6f2dd>
    '[email protected]' on 04-May-10 11:48 AM
    550 5.7.1 Message content rejected <c2c672707936339ea5c92f03ada6f2dd>
    '[email protected]' on 04-May-10 11:48 AM
    550 5.7.1 Message content rejected <c2c672707936339ea5c92f03ada6f2dd>
    Regards

  • Outgoing mail rejected as spam?

    I attempted to send a message this morning and it was rejected with the following:
    Diagnostic-code: smtp;550 5.7.1 Message rejected as spam by Content Filtering.
    I figured there was some sort of mistake somewhere so I tried resending the message. Same result. How come iCloud is rejecting my outgoing messages as spam?

    Great, more help desk idiots! There are no Thunderbird servers. Thunderbird is software that runs on YOUR computer and connects to your email providers server. The message would be from THEIR server.

  • High Amount of Spam on Exchange 2013 - Content Filtering is Enabled but Pfizer Spam Filling Up Everyone's Mailboxes

    Hello
    Previously I used Exchange 2010 with Forefront Threat Protection installed and this used to do a good job of stopping all the spam.
    However since updating to Exchange 2013 earlier this year and enabling the integrated spam filtering everyone noticed a sudden increase in the amount of spam which was getting through which has been bad for a long time.
    We have been living with it but in the last 3 weeks everyone has started getting about 40 emails a day from Pfizer for Viagra. All these seem to defeat the content filtering as Viagra is spelt with an extra I and the email address is always different.
    Also images in emails are blocked by default but somehow all the images on these spam messages appear for everyone.
    I am not sure the spam filtering is working at all and I'm not sure how to tell as ForeFront gives you a nice graphical dashboard but I can find nothing similar to this in Exchange and PowerShell seems the only way to configure the limited functionality
    of the content filter.
    Is there any way to get rid of these messages as it doesn't look very good when they are constantly popping up for everyone?
    Thanks
    Robin
    Robin Wilson

    Hello ManU
    Thanks for the reply.
    I have checked the logs and see this quite often:
    AcceptMessage,,SCL,not available: policy is disabled
    But other times it says this:
    RejectMessage,550 5.7.1 Message rejected as spam by Content Filtering
    Which seems to indicate it is rejecting some.
    This is what one of the email headers look like:
    Received: from RWS-MAIL.rwsservices.net (192.168.2.151) by
    RWS-MAIL.rwsservices.net (192.168.2.151) with Microsoft SMTP Server (TLS) id
    15.0.775.38 via Mailbox Transport; Sat, 28 Dec 2013 10:59:26 +0000
    Received: from RWS-MAIL.rwsservices.net (192.168.2.151) by
    rws-mail.rwsservices.net (192.168.2.151) with Microsoft SMTP Server (TLS) id
    15.0.775.38; Sat, 28 Dec 2013 10:58:38 +0000
    Received: from [90.169.106.204] (90.169.106.204) by mail.rwsservices.net
    (192.168.2.151) with Microsoft SMTP Server id 15.0.775.38 via Frontend
    Transport; Sat, 28 Dec 2013 10:58:37 +0000
    Date: Sat, 28 Dec 2013 12:05:58 +0200
    From: US.Pfizer eStore <[email protected]>
    To: robin.wilson <[email protected]>
    Message-ID: <[email protected]>
    Subject: Dear robin.wilson up to 65% OFF!
    X-Mailer: Airmail (223)
    MIME-Version: 1.0
    Content-Type: multipart/mixed; boundary="dd2ee3ea_586bb9e4_6f04"
    Return-Path: [email protected]
    X-MS-Exchange-Organization-PRD: 001-taxis.co.uk
    X-MS-Exchange-Organization-SenderIdResult: Neutral
    Received-SPF: Neutral (rws-mail.rwsservices.net: 90.169.106.204 is neither
    permitted nor denied by domain of [email protected])
    X-MS-Exchange-Organization-Network-Message-Id: e8825204-1f32-48be-a331-08d0d1d30209
    X-MS-Exchange-Organization-SCL: 1
    X-MS-Exchange-Organization-PCL: 2
    X-MS-Exchange-Organization-Antispam-Report: DV:3.3.13223.464;SID:SenderIDStatus Neutral;OrigIP:90.169.106.204
    X-EXCLAIMER-MD-CONFIG: 079171ba-394f-46d5-a160-56e416712e8e
    X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
    X-MS-Exchange-Organization-AuthSource: rws-mail.rwsservices.net
    X-MS-Exchange-Organization-AuthAs: Anonymous
    The emails use a different sender email address every time and there is always a poem in very light grey writing in the body of the email. The drugs are always misspelt as well. Is this why these are getting through?
    Thanks
    Robin
    Robin Wilson

  • Message filters vs Content Filters

    Differences:
    1. Message filters occur earlier in the email pipeline than content filters. Message filters before the email goes into the workqueue. The content filters occur inside the workqueue.
    2. Message filters are currently only administered from the command line. Content filters can be administered from both the CLI and the GUI interface, however, the GUI interface is the recommended mehtod.
    3. Content filters have an inbound and an outbound set of content filters, depending upon the direction of the message. That is, whether it's a relayed email (outgoing content filters) or inbound mail(inbound content filters). Message filters on the other hand, are autmoatically applied to both inbound and outgoing traffic, unless you lock it down to a specific listener. If you only have one listener, you may need to differentiate your flow of traffic by sendergroups or something else.
    4. Message filters and content filters can pretty much have the same conditions and actions. However, message filters allow for if-else conditions, so they are more robust.
    5. You can use message and content filters in unison. For example, use a message filter to insert a custom header that you content filter can key off of. However, this does not work the other way around. You cannot insert a custom header in the content filter and have the message filter key off of that info. Due to the way the email pipeline is set up, message filters come first, then content filters.
    6. Easy of use: content filters are a bit more intuitive and user-friendly. message filters are more advanced, so it has a bigger learning curve.
    7. Content filters used with customized incoming or outgoing mail policies allow you to splinter messages. Splintering messages allow you to split messages up by recipients. Message filters don't allow splintering and are applied to the entire message.
    AsyncOS User Guide: Content Filters Overview
    https://support.ironport.com/docs/c_series/4.6/HTML_4.6_Compilation/AsyncOS_4.6_User_Guide/AsyncOS_4.6_User_Guide-12-3.html
    AsyncOS User Guide: Message Filters
    https://support.ironport.com/docs/c_series/4.6/HTML_4.6_Compilation/AsyncOS_4.6_Adv_User_Guide/AsyncOS_4.6_Adv_User_Guide-09-2.html
    AsyncOS User Guide: Email Pipeline
    https://support.ironport.com/docs/c_series/4.6/HTML_4.6_Compilation/AsyncOS_4.6_User_Guide/AsyncOS_4.6_User_Guide-09-2.html

    Actually, I just did a test on this and your point is half correct.
    It's not the content filter that does the splintering, it's either the incoming or outgoing mail policy that does the splintering.
    For example, if you only have one Default outgoing policy and an outgoing content filter that drops the mail if the destination is @yahoo.com.
    If you sent in a test email with two recipients: [email protected] and [email protected]
    Then the entire message would get dropped since there was only one Default outgoing policy.
    However, you can allow for splintering if you had additional custom policies.
    For example,
    1. gmail-recipients
    2. yahoo-recipients
    3. Default policy
    In that case, your test email would split into two separate emails and then you could have the content filters apply to each separately.
    You are correct that message filters apply to the entire message and does not allow for message splintering.
    However, content filtering, message splintering is only applicable if you have additional custom policy, either inbound or outgoing.
    So, in additional to the requirement of mutliple recipients, you also need multiple policies, otherwise, have multiple recipients and only one Default policy will affect the entire message also.
    Thanks for the attention to detail.
    You've missed one of the biggest differences...
    Message filters act on a _message_. Content filters act on a message/recipient pair.
    If a message is only going to a single person then there's not any difference, but if a message is addresses to multiple people then the message filter will take the same action for all recipients, whilst the content filter will split ("splinter") the one message into multiple messages, with one (or possibly more) recipients each, and then act on each individually.

  • Email message rejected for possible spam/virus content

    When I do a Reply All on an email that includes my own Mail email address in the recipient list, the reply is delivered to everyone but me.  I get a [email protected] email with a Diagnostic code: "smtp;553 5.3.0 17.158.232.236 Your message was rejected for possible spam/virus content.Please ask your email provider to visithttp://emailadmin.registeredsite.com for resolution." 
    This never happened before.  The only thing that has changed on my system is that I have recently installed Webroot SecureAnywhere antivirus.  Any ideas?

    I suggest you contact godaddy for some support using their mail service.

  • Email rejected as spam because of  "RCPT TO" ?

    I'm attempting to use Mail and compare it to Entourage. Email sent to a friend is getting rejected as spam when sent from Mail, but not from Entourage. Both are using the same account.
    The returned email includes the message below with domains and ip addresses removed "to protect the innocent". Does anyone have a clue as to what the difference is and how I might fix it?
    Diagnostic-Code: X-Spam-Firewall; host friendsdomain.com[...IP address...] said:
    550-"JunkMail rejected - smtp57.dc2.safesecureweb.com [...IP address...] is in
    an 550 RBL, see http://www.spamhaus.org/query/bl?ip=...IP address..." (in reply
    to RCPT TO command)

    For whatever reason the ISP's smtp server got put on the Spamhaus list. They, the ISP, got it removed removed and all id better now. Phew.

  • 550 5.7.1 Command rejected

    I've seen some other threads about this type of problem, but no resolution for it so I thought I'd post to help HP to know how widespread and disappointing this is.
    It appears, from reading other threads, that the eprint email system on HP's end of things is extremely finicky about what emails it will accept.
    This is not acceptable.  If a person's email setup, client, computer system, and ISP works fine for them for every purpose except eprint, then the problem is at HP's end of things.  And this is the problem I'm having now.
    We bought this printer to put at my mother's house so that the rest of the family could send photos or notes to her from their email accounts.  She doesn't have the desire or computer savvy to constantly troubleshoot problems with this all.
    I've spent about the last eight hours fighting through a succession of problems just getting this printer to connect to the wireless router, then connect to the eprint center, and now, with all of that seeming to work, all of my emails to the printer's email address are being rejected "bounced" with this error coming back:
    "This message was created automatically by the mail system (ecelerity).
    A message that you sent could not be delivered to one or more of its
    recipients. This is a permanent error. The following address(es) failed:
    >>> [email protected] (reading confirmation): 550 5.7.1 Command rejected"
    When can we expect the eprint service to work properly for ALL otherwise perfectly functional email setups on my family's various computers, ISPs, and devices?

    I have identified and solved this problem in our environment, just today. That's the good news. The bad news is that if my solution applies to your environment, as a consumer there may not be anything you can do about it personally. I happen to be both an affected business user and an affected consumer; with an HP Eprint-enabled printer in both environments, and a mail administrator and DNS adminstrator for my company's Exchange 2007 mail organization. So I was perhaps rather uniquely situated to study this problem and to resolve it.
    There is an internet standard known as SPF (referred to in the MS world as SenderID.) SPF stands for Sender Policy Framework. It involves a DNS administrator putting a TXT record in DNS that identifies, by IP address, the mail servers from which email from your domain may properly come.
    When email purporting to be from your domain ([email protected]) arrives at an MX server, the MX server (if it is implementing SPF; not all do) will do a DNS lookup for your sender-side SPF record. The SPF record will say, in effect, "If this email from @mydomain.com is coming from 12.98.67.216, or an address within the 64.15.8.0/24 network, then that is a valid IP source address. If not, there's something skanky about that email's origins; it may be spam, being sent from an inappropriate soure; that is, its sender address [email protected] has probably been spoofed. React accordingly."
    In our case, HPEPRINT's PostFix mail server was apparently finding something in our SPF/v2.0 record it did not like (we have had that record for several years and none of our email has ever bounced for this reason, so I am not sure exactly what the issue was, but...). I deleted our SPF 2.0 record and the problem with HPEPRINT vanished immediately. We have had 100% email-printing success since then, and no more "rejected" NDRs from hpeprint.com.
    We still have an SPF/v1 record in our DNS, which HP's PostFix mail server apparently likes well enough. The issue in our case was with our SPF/v2.0 record, or the way PostFix was evaluating it. I'm not sure which. If our SPF record was bad, I have to wonder why we haven't had problems with any other mail domain during the last four years or more since I created that record. But anyhow..
    The main moral based on our situation is: this was NOT a problem with the printer. It MAY HAVE BEEN a problem with the way hpeprint.com's mail server evaluated SPFv2 records. It MAY HAVE BEEN a problem with our SPFv2.0 record syntax or structure. But the printers in this respect are just fine. If you are sending mail through an ISP or a company email system and are not in a position to fix it, talk to your mail administrator about it and suggest he check SPF records.
    The tipoff in my case was when I tried to send to hpepprint.com from the command line and got the blowback from hpeprint.com's PostFix:
    "#550 5.7.1 Can't determine Purported Responsible Address." 
    In referring this error back to our senders, Exchange was paraphrasing as
    #550 5.7.1 Command rejected
    The PRA is SPF-speak.

  • When trying to send E-mail via AOL i get the message "rejected by the server because it does not allow relaying" I have checked settings as per answers to similar question

    When trying to send E-mail via AOL i get the message "rejected by the server because it does not allow relaying" I have checked settings as per answers to similar question

    From which account does the email not send?  When sending from an account, the iPad will first try to use the aoutgoing server for that account.  If it can't it will try the other accounts listed.in the setting on the iPad for that account.  It soulds like the server for the account is not working and that the alternate server is resjecting the messag since it did not originate ffrom the account associated with that server,  That is to prevent sending spam.

  • 50%+ Webmail & Outlook Sent messages blocked as spam in last week. HELP!!!

    I'm having many of my Outlook and Web mail messages blocked as spam. More than 50% of  Message contents on web page says:
    Unable to Send Message.
    Unable to send e-mail: 550 5.7.1 The message you attempted to sedn was determined to be spam.  Please visit http://www.verizon.net/spamfaq for more information. 
    Comtents of my message included two web site links.  Title of message = Wide Clics
    Contents of message as follows:
    Here are web pages for Clic readers that might be useful.
    http://shop.sportclic.com/product.sc;jsessionid=458673868CA19764DE4A4109497614AC.qscstrfrnt03?produc...
    http://shop.sportclic.com/images/DSCF0094.jpg
    Dean Pugh
    Why is the above considered spam?   
    I have tried changing port to 587 and have finally been able to send info to the spam web page.  Hopefully they can correct this soon.  I never had this problem with Comcast.  Hope to resolve ASAP or will be canceling all my server with verizon.  Thanks for any suggestion!

    The best way to resolve this issue is to send the message as an attachment to [email protected] so the message an be reviewed and the filters updated. Unfortunately, you won't get a response back about the status/result of this process. The filter is scanning the content of your message for anything that "looks" like spam.
    Some troubleshooting steps you can try on your own:
    If you have a signature, try removing one line at a time from it and attempting to send the message again. Some signatures look like "ads" to the filters, apparently.
    If you are using a pop3 client (Outlook, Outlook Express, etc.) try sending your message from the verizon.net website. If this resolves the issue, then it is something that your client is adding to the message that is causing it to be blocked.
    If the Subject line of your message has a whole bunch of "Fwd: Fwd: Re: Fwd:" try removing some of them.
    If a forum member gives an answer you like, give them the Kudos they deserve. If a member gives you the answer to your question, mark the answer as Accepted Solution so others can see the solution to the problem.
    "All knowledge is worth having."

  • 550 #5.1.0 Address rejected

    Generating server: spamfirewall.xxx.xxx
    [email protected]
    #< #5.0.0 X-Spam-&-Virus-Firewall; host unmcip1.unmc.edu[192.198.54.156] said: 550 #5.1.0 Address rejected. (in reply to RCPT TO command)> #SMTP#
    please advice. Thank You

    Hi,
    I recommend that you use the following link to check if your domain name in the blacklist:
    http://mxtoolbox.com/
    Thanks.
    Niko Cheng
    TechNet Community Support

  • Email being rejected as spam

    HP OfficeJet 6500A on a Win 7 Pro System.
    I've read the other responses to people having this problem and found nothing that resolved the problem.
    I've sent several emails to my printer and they were rejected as spam and deleted.
    The emails contain an MS Word document that is about 13k and a jpg file that is about 15k.
    The subject of the email id "Hi" or "test"
    These are simple files that I am using to test how the system works and it appears that it doesn't.
    Has anyone gotten this to work?
    Your help is appreciated.

    Its mainly to filter out things like small adds or smilies in signatures. If they werent spam filtered and someone had say 5 of those on the signature of an email, a page would print out for each. The other thing to look out for if it is being rejected as spam is that you have no one in the CC and BCC fields. The next most common factor in spam is the message being sent to dozens of people at once, so you can only send an eprint email to the eprint address, not to others at the same time.
    If it still fails after this try sending just an image, and see if that has ant effect. The next step would be possibly trying another email address, as sometimes they add things in to the signature without you knowing.
    Jon-W
    I work on behalf of HP
    Please click “Accept as Solution ” on the post that solves your issue to help others find the solution.
    Click the KUDOS STAR on the left to say “Thanks” for helping!

Maybe you are looking for