Obvious spam has SCL of -1?

Question

For some time now, our junk mail filtering has... I believe the technical term is "sucked". We get a LOT of spam and just wade through it manually. SBS2K8, Exchange 2010, Forefront Protection for Exchange server 2010, everything is up to date,
I run a clean ship, yada, yada. Whatever, I'm certainly missing something here.
So, just as an example, here are the headers from an email that DID go into the junk mail folder:
Received: from server.isrinfo.com (162.144.61.128) by
remote.myserver.com (192.168.1.8) with Microsoft SMTP Server (TLS)
id 8.3.389.2; Sat, 3 Jan 2015 01:44:07 -0800
Received: from [41.83.29.1] (port=49318 helo=[192.168.1.14]) by
server.isrinfo.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.82)
(envelope-from <[email protected]>) id 1Y7LF5-00086v-WD; Sat, 03 Jan 2015
03:43:32 -0600
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Congratulations!!!
To: Recipients <[email protected]>
From: Apple Free Lotto <[email protected]>
Date: Sat, 3 Jan 2015 10:43:11 +0100
Reply-To: <[email protected]>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.isrinfo.com
X-AntiAbuse: Original Domain -myserver.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - apl.com
X-Get-Message-Sender-Via: server.isrinfo.com: authenticated_id: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:
Message-ID: <[email protected]>
Return-Path: [email protected]
X-MS-Exchange-Organization-PRD: apl.com
X-MS-Exchange-Organization-SenderIdResult: Fail
Received-SPF: Fail (myserver.local: domain of [email protected] does not
designate 162.144.61.128 as permitted sender) receiver=myserver.local;
client-ip=162.144.61.128; helo=server.isrinfo.com;
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Organization-Antispam-Report: v=2.1 cv=IL07VGfG c=1 sm=1 tr=0
a=z4H3oloq9kORX9Whg1f/Yw==:117 a=z4H3oloq9kORX9Whg1f/Yw==:17
a=8nJEP1OIZ-IA:10 a=n-nyA-wvAAAA:8 a=7YfXLusrAAAA:8 a=UFJYYV1tAAAA:8
a=XikixVyBAAAA:8 a=YNv0rlydsVwA:10 a=p_jAZ8I-e1rTrDgkLWcA:9
a=KxcaETtowfxUaaLN:21 a=Ajzh68oZL4escxSj:21 a=wPNLvfGTeEIA:10
a=WJtCvEN6LCgA:10 a=Xi1c__XFz18A:10 a=L39cjW1yEkYA:10
a=76LxldoYk5kA:10;OrigIP:162.144.61.128;SCL:-1
But even though it WAS correctly sorted, notice this
X-MS-Exchange-Organization-SCL: -1
despite this:
X-MS-Exchange-Organization-SenderIdResult: Fail
Received-SPF: Fail (myserver.local: domain of [email protected] does not
designate 162.144.61.128 as permitted sender) receiver=myserver.local;
client-ip=162.144.61.128; helo=server.isrinfo.com;
It's obviously spam, and I do NOT have the spam detection settings turned off. I think. Here is another one that came through into my inbox... full of information about... enhancing the performance of a certain part of the male anatomy... I mean it was the
poster child for obvious spam:
Received: from mail.gessimo.net (41.142.244.55) by
myserver.com (192.168.1.8) with Microsoft SMTP Server (TLS)
id 8.3.389.2; Fri, 2 Jan 2015 15:46:55 -0800
Received: from XeamsSB (192.168.8.90) by mail.gessimo.net (192.168.8.83) with
Microsoft SMTP Server id 14.2.318.4; Fri, 2 Jan 2015 23:46:05 +0000
X-SMScore: 142
X-LCID: 1483303
Received: from [(177.11.54.75)] by XeamsSB with Xeams SMTP; Fri, 2 Jan 2015
18:45:43 -0500 (ACT)
X-SM_RECEIVED_ON: Fri, 2 Jan 2015 18:45:43 -0500 (ACT)
From: Evellyn <[email protected]>
Subject: Re: Amigo, =?ISO-8859-1?Q?n=E3o est=E1?= satisfeito com o tamanho?
Isto pode te ajudar!
To: <[email protected]>
Content-Type: text/html
Reply-To: <[email protected]>
Date: Fri, 2 Jan 2015 21:46:20 -0200
MIME-Version: 1.0
Message-ID: <[email protected]>
Return-Path: [email protected]
X-MS-Exchange-Organization-PRD: sbbc.ma
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (myserver.local: [email protected] does not designate
permitted sender hosts)
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Organization-Antispam-Report: v=2.1 cv=IL07VGfG c=1 sm=1 tr=0
a=cQ8Xs7I8qLQtykOxfzBuAg==:117 a=cQ8Xs7I8qLQtykOxfzBuAg==:17
a=jPJDawAOAc8A:10 a=Qfr2whkWTHcA:10 a=egK9k7A5aEgA:10 a=ZyurR0c_AAAA:8
a=Wem7T-hmAAAA:8 a=XikixVyBAAAA:8 a=YNv0rlydsVwA:10 a=SSmOFEACAAAA:8
a=Pe5aYLDLvP2KgpxZgOYA:9 a=HbKjNsmSVnptcH_q:21 a=_W_S_7VecoQA:10
a=MZpOI37Du90A:10;OrigIP:41.142.244.55;SCL:-1
In the Exchange Management Console, Org..., Hub... Anti-spam, all the options are enabled. In Content Filtering, I have NO exceptions, and Action is set to reject messages with SCL > 7. (no deleting or quarantining), blocklists from zen.spamhaus.org and
bl.spamcop.net. Pretty standard config as far as I can tell... 
In Forefront, I have everything enabled, including sender ID filtering which is supposed to stamp the header and continue. SCL thresholds are 5to8 and again, it's supposed to stamp the header at this point. At SCL=9, it's supposed to reject. 
But I've never seen an email with anything other than SCL=-1. Why?

Answer 1

[PS] C:\Windows\System32>Get-ContentFilterConfig
Name : ContentFilterConfig
RejectionResponse : Message rejected as spam by Content Fil
tering.
OutlookEmailPostmarkValidationEnabled : True
BypassedRecipients : {}
QuarantineMailbox :
SCLRejectThreshold : 7
SCLRejectEnabled : True
SCLDeleteThreshold : 9
SCLDeleteEnabled : False
SCLQuarantineThreshold : 9
SCLQuarantineEnabled : False
BypassedSenders : {}
BypassedSenderDomains : {}
Enabled : True
ExternalMailEnabled : True
InternalMailEnabled : False
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
DistinguishedName : CN=ContentFilterConfig,CN=Message Hygie
ne,CN=Transport Settings,CN=First Organ
ization,CN=Microsoft Exchange,CN=Servic
es,CN=Configuration,DC=mydomain,DC=local
Identity : ContentFilterConfig
Guid : 2faa4ced-2f01-40f1-9dc8-4131fde9c87b
ObjectCategory : mydomain.local/Configuration/Schema/ms-E
xch-Message-Hygiene-Content-Filter-Conf
ig
ObjectClass : {top, msExchAgent, msExchMessageHygiene
ContentFilterConfig}
WhenChanged : 10/22/2014 12:14:32 PM
WhenCreated : 3/8/2012 5:00:37 PM
OriginatingServer : myserver.mydomain.local
IsValid : True
[PS] C:\Windows\System32>Get-IPAllowListEntry
Identity IPRange ExpirationTime HasExpir
ed
2 192.251.125.0-192.251.125... 12/31/9999 3:59:59 PM False
3 216.200.145.17-216.200.14... 12/31/9999 3:59:59 PM False
4 62.95.91.206-62.95.91.207 12/31/9999 3:59:59 PM False
5 72.35.86.162 12/31/9999 3:59:59 PM False
7 208.65.145.65 12/31/9999 3:59:59 PM False
8 192.168.1.8-192.168.1.255 12/31/9999 3:59:59 PM False
Get-IPAllowListProvider returns nothing.
Get-ReceiveConnector | FL returns all this:
AuthMechanism : Tls, Integrated, BasicAuth, BasicAuth
RequireTLS, ExchangeServer
Banner :
BinaryMimeEnabled : True
Bindings : {192.168.1.8:25}
ChunkingEnabled : True
DefaultDomain :
DeliveryStatusNotificationEnabled : True
EightBitMimeEnabled : True
DomainSecureEnabled : False
EnhancedStatusCodesEnabled : True
LongAddressesEnabled : False
OrarEnabled : False
Fqdn : myserver.mydomain.local
Comment :
Enabled : True
ConnectionTimeout : 00:10:00
ConnectionInactivityTimeout : 00:05:00
MessageRateLimit : unlimited
MaxInboundConnection : 5000
MaxInboundConnectionPerSource : unlimited
MaxInboundConnectionPercentagePerSource : 100
MaxHeaderSize : 64KB
MaxHopCount : 30
MaxLocalHopCount : 8
MaxLogonFailures : 3
MaxMessageSize : 10MB
MaxProtocolErrors : 5
MaxRecipientsPerMessage : 5000
PermissionGroups : AnonymousUsers, ExchangeUsers, Exchan
geServers, ExchangeLegacyServers, Cus
tom
PipeliningEnabled : True
ProtocolLoggingLevel : None
RemoteIPRanges : {127.0.0.1, 192.168.1.3-192.168.1.255
, 192.168.1.0-192.168.1.1}
RequireEHLODomain : False
RequireTLS : False
EnableAuthGSSAPI : False
ExtendedProtectionPolicy : None
ExtendedProtectionTlsTerminatedAtProxy : False
Server : myserver
SizeEnabled : EnabledWithoutValue
TarpitInterval : 00:00:05
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : Default myserver
DistinguishedName : CN=Default myserver,CN=SMTP Receive Conn
ectors,CN=Protocols,CN=myserver,CN=Serve
rs,CN=Exchange Administrative Group (
FYDIBOHF23SPDLT),CN=Administrative Gr
oups,CN=First Organization,CN=Microso
ft Exchange,CN=Services,CN=Configurat
ion,DC=mydomain,DC=local
Identity : myserver\Default myserver
Guid : 79df4c8b-d6c2-4ddc-ad84-d46ab184b517
ObjectCategory : mydomain.local/Configuration/Schema/ms
-Exch-Smtp-Receive-Connector
ObjectClass : {top, msExchSmtpReceiveConnector}
WhenChanged : 4/18/2012 8:42:43 AM
WhenCreated : 3/8/2012 5:05:13 PM
OriginatingServer : myserver.mydomain.local
IsValid : True
AuthMechanism : BasicAuth
Banner :
BinaryMimeEnabled : True
Bindings : {127.0.0.1:25}
ChunkingEnabled : True
DefaultDomain :
DeliveryStatusNotificationEnabled : True
EightBitMimeEnabled : True
DomainSecureEnabled : False
EnhancedStatusCodesEnabled : True
LongAddressesEnabled : False
OrarEnabled : False
Fqdn : myserver.mydomain.local
Comment :
Enabled : True
ConnectionTimeout : 06:00:00
ConnectionInactivityTimeout : 00:05:00
MessageRateLimit : unlimited
MaxInboundConnection : 5000
MaxInboundConnectionPerSource : 20
MaxInboundConnectionPercentagePerSource : 2
MaxHeaderSize : 64KB
MaxHopCount : 30
MaxLocalHopCount : 8
MaxLogonFailures : 3
MaxMessageSize : 10MB
MaxProtocolErrors : 5
MaxRecipientsPerMessage : 200
PermissionGroups : AnonymousUsers, ExchangeUsers
PipeliningEnabled : True
ProtocolLoggingLevel : None
RemoteIPRanges : {127.0.0.1-127.0.0.1}
RequireEHLODomain : False
RequireTLS : False
EnableAuthGSSAPI : False
ExtendedProtectionPolicy : None
ExtendedProtectionTlsTerminatedAtProxy : False
Server : myserver
SizeEnabled : Enabled
TarpitInterval : 00:00:05
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : Windows SBS Fax Sharepoint Receive TS
500
DistinguishedName : CN=Windows SBS Fax Sharepoint Receive
myserver,CN=SMTP Receive Connectors,CN=
Protocols,CN=myserver,CN=Servers,CN=Exch
ange Administrative Group (FYDIBOHF23
SPDLT),CN=Administrative Groups,CN=Fi
rst Organization,CN=Microsoft Exchang
e,CN=Services,CN=Configuration,DC=efp
lus4,DC=local
Identity : myserver\Windows SBS Fax Sharepoint Rece
ive myserver
Guid : e65dac21-4aa0-49d4-9a1e-5a511b00e57f
ObjectCategory : mydomain.local/Configuration/Schema/ms
-Exch-Smtp-Receive-Connector
ObjectClass : {top, msExchSmtpReceiveConnector}
WhenChanged : 3/8/2012 5:17:01 PM
WhenCreated : 3/8/2012 5:17:01 PM
OriginatingServer : myserver.mydomain.local
IsValid : True
AuthMechanism : Tls
Banner :
BinaryMimeEnabled : True
Bindings : {192.168.1.8:25}
ChunkingEnabled : True
DefaultDomain :
DeliveryStatusNotificationEnabled : True
EightBitMimeEnabled : True
DomainSecureEnabled : False
EnhancedStatusCodesEnabled : True
LongAddressesEnabled : False
OrarEnabled : False
Fqdn : remote.electronicformsplus.com
Comment :
Enabled : True
ConnectionTimeout : 00:10:00
ConnectionInactivityTimeout : 00:01:00
MessageRateLimit : unlimited
MaxInboundConnection : 5000
MaxInboundConnectionPerSource : 20
MaxInboundConnectionPercentagePerSource : 2
MaxHeaderSize : 64KB
MaxHopCount : 30
MaxLocalHopCount : 8
MaxLogonFailures : 3
MaxMessageSize : 10MB
MaxProtocolErrors : 5
MaxRecipientsPerMessage : 200
PermissionGroups : AnonymousUsers
PipeliningEnabled : True
ProtocolLoggingLevel : None
RemoteIPRanges : {192.168.1.2-192.168.1.2, 192.168.1.0
-255.255.255.255, 0.0.0.0-192.167.255
.255}
RequireEHLODomain : False
RequireTLS : False
EnableAuthGSSAPI : False
ExtendedProtectionPolicy : None
ExtendedProtectionTlsTerminatedAtProxy : False
Server : myserver
SizeEnabled : Enabled
TarpitInterval : 00:00:05
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : Windows SBS Internet Receive myserver
DistinguishedName : CN=Windows SBS Internet Receive myserver
,CN=SMTP Receive Connectors,CN=Protoc
ols,CN=myserver,CN=Servers,CN=Exchange A
dministrative Group (FYDIBOHF23SPDLT)
,CN=Administrative Groups,CN=First Or
ganization,CN=Microsoft Exchange,CN=S
ervices,CN=Configuration,DC=mydomain,D
C=local
Identity : myserver\Windows SBS Internet Receive TS
500
Guid : 753d4f8f-e372-4a91-a41c-777afb2a3ba2
ObjectCategory : mydomain.local/Configuration/Schema/ms
-Exch-Smtp-Receive-Connector
ObjectClass : {top, msExchSmtpReceiveConnector}
WhenChanged : 4/4/2012 3:04:08 PM
WhenCreated : 3/9/2012 5:32:42 PM
OriginatingServer : myserver.mydomain.local
IsValid : True
AuthMechanism : ExternalAuthoritative
Banner :
BinaryMimeEnabled : True
Bindings : {0.0.0.0:25}
ChunkingEnabled : True
DefaultDomain :
DeliveryStatusNotificationEnabled : True
EightBitMimeEnabled : True
DomainSecureEnabled : False
EnhancedStatusCodesEnabled : True
LongAddressesEnabled : False
OrarEnabled : False
Fqdn : myserver.mydomain.local
Comment :
Enabled : True
ConnectionTimeout : 00:10:00
ConnectionInactivityTimeout : 00:05:00
MessageRateLimit : unlimited
MaxInboundConnection : 5000
MaxInboundConnectionPerSource : 20
MaxInboundConnectionPercentagePerSource : 2
MaxHeaderSize : 64KB
MaxHopCount : 30
MaxLocalHopCount : 8
MaxLogonFailures : 3
MaxMessageSize : 10MB
MaxProtocolErrors : 5
MaxRecipientsPerMessage : 200
PermissionGroups : ExchangeServers
PipeliningEnabled : True
ProtocolLoggingLevel : None
RemoteIPRanges : {192.168.1.10-192.168.1.19, 192.168.1
.9, 192.168.1.41-192.168.1.42, 192.16
8.0.100-192.168.1.110}
RequireEHLODomain : False
RequireTLS : False
EnableAuthGSSAPI : False
ExtendedProtectionPolicy : None
ExtendedProtectionTlsTerminatedAtProxy : False
Server : myserver
SizeEnabled : Enabled
TarpitInterval : 00:00:05
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : updates
DistinguishedName : CN=updates,CN=SMTP Receive Connectors
,CN=Protocols,CN=myserver,CN=Servers,CN=
Exchange Administrative Group (FYDIBO
HF23SPDLT),CN=Administrative Groups,C
N=First Organization,CN=Microsoft Exc
hange,CN=Services,CN=Configuration,DC
=mydomain,DC=local
Identity : myserver\updates
Guid : f103f9f5-f3c4-4ff4-b1a8-4cc67d7b7ee3
ObjectCategory : mydomain.local/Configuration/Schema/ms
-Exch-Smtp-Receive-Connector
ObjectClass : {top, msExchSmtpReceiveConnector}
WhenChanged : 6/3/2013 11:48:19 AM
WhenCreated : 4/4/2012 12:52:11 PM
OriginatingServer : myserver.mydomain.local
IsValid : True
AuthMechanism : Tls
Banner :
BinaryMimeEnabled : True
Bindings : {0.0.0.0:465}
ChunkingEnabled : True
DefaultDomain :
DeliveryStatusNotificationEnabled : True
EightBitMimeEnabled : True
DomainSecureEnabled : False
EnhancedStatusCodesEnabled : True
LongAddressesEnabled : False
OrarEnabled : False
Fqdn : myserver.mydomain.local
Comment :
Enabled : True
ConnectionTimeout : 00:10:00
ConnectionInactivityTimeout : 00:05:00
MessageRateLimit : unlimited
MaxInboundConnection : 5000
MaxInboundConnectionPerSource : 20
MaxInboundConnectionPercentagePerSource : 2
MaxHeaderSize : 64KB
MaxHopCount : 30
MaxLocalHopCount : 8
MaxLogonFailures : 3
MaxMessageSize : 10MB
MaxProtocolErrors : 5
MaxRecipientsPerMessage : 200
PermissionGroups : AnonymousUsers
PipeliningEnabled : True
ProtocolLoggingLevel : None
RemoteIPRanges : {192.168.1.0-255.255.255.255, 192.168
.0.2-192.168.1.2, 0.0.0.0-192.167.255
.255}
RequireEHLODomain : False
RequireTLS : False
EnableAuthGSSAPI : False
ExtendedProtectionPolicy : None
ExtendedProtectionTlsTerminatedAtProxy : False
Server : myserver
SizeEnabled : Enabled
TarpitInterval : 00:00:05
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : Port 465
DistinguishedName : CN=Port 465,CN=SMTP Receive Connector
s,CN=Protocols,CN=myserver,CN=Servers,CN
=Exchange Administrative Group (FYDIB
OHF23SPDLT),CN=Administrative Groups,
CN=First Organization,CN=Microsoft Ex
change,CN=Services,CN=Configuration,D
C=mydomain,DC=local
Identity : myserver\Port 465
Guid : c265179c-9276-4a38-8a92-0a8367ff93c9
ObjectCategory : mydomain.local/Configuration/Schema/ms
-Exch-Smtp-Receive-Connector
ObjectClass : {top, msExchSmtpReceiveConnector}
WhenChanged : 4/18/2012 8:43:03 AM
WhenCreated : 4/9/2012 3:11:26 PM
OriginatingServer : myserver.mydomain.local
IsValid : True
AuthMechanism : Tls
Banner :
BinaryMimeEnabled : True
Bindings : {0.0.0.0:587}
ChunkingEnabled : True
DefaultDomain :
DeliveryStatusNotificationEnabled : True
EightBitMimeEnabled : True
DomainSecureEnabled : False
EnhancedStatusCodesEnabled : True
LongAddressesEnabled : False
OrarEnabled : False
Fqdn : myserver.mydomain.local
Comment :
Enabled : True
ConnectionTimeout : 00:10:00
ConnectionInactivityTimeout : 00:05:00
MessageRateLimit : unlimited
MaxInboundConnection : 5000
MaxInboundConnectionPerSource : 20
MaxInboundConnectionPercentagePerSource : 2
MaxHeaderSize : 64KB
MaxHopCount : 30
MaxLocalHopCount : 8
MaxLogonFailures : 3
MaxMessageSize : 10MB
MaxProtocolErrors : 5
MaxRecipientsPerMessage : 200
PermissionGroups : AnonymousUsers
PipeliningEnabled : True
ProtocolLoggingLevel : None
RemoteIPRanges : {192.168.1.0-255.255.255.255, 192.168
.0.2, 0.0.0.0-192.167.255.255}
RequireEHLODomain : False
RequireTLS : False
EnableAuthGSSAPI : False
ExtendedProtectionPolicy : None
ExtendedProtectionTlsTerminatedAtProxy : False
Server : myserver
SizeEnabled : Enabled
TarpitInterval : 00:00:05
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : Port 587
DistinguishedName : CN=Port 587,CN=SMTP Receive Connector
s,CN=Protocols,CN=myserver,CN=Servers,CN
=Exchange Administrative Group (FYDIB
OHF23SPDLT),CN=Administrative Groups,
CN=First Organization,CN=Microsoft Ex
change,CN=Services,CN=Configuration,D
C=mydomain,DC=local
Identity : myserver\Port 587
Guid : ebbb4c3a-dece-45f5-976b-8b7bd33a21d9
ObjectCategory : mydomain.local/Configuration/Schema/ms
-Exch-Smtp-Receive-Connector
ObjectClass : {top, msExchSmtpReceiveConnector}
WhenChanged : 4/18/2012 8:43:09 AM
WhenCreated : 4/9/2012 3:13:59 PM
OriginatingServer : myserver.mydomain.local
IsValid : True