Suddenly getting a lot of SPAM but header shows SCL of -1?

Question

I have Exchange 2010 with Forefront Protection for Exchange installed on the same box. About two weeks ago, I suddenly began getting a ton of spam messages and many users reporting an increase in junk mail. I started to research and found the SCL in the
headers is being set to -1 and allowing these mails through. I have 2 receive connectors configured. One is for external mails and the other is for internal things like copiers and it's secured by those particular IP addresses. I need to get this fixed
so any help is greatly appreciated. Below are a few of the headers from spam mails.
Received: from bawright.madbunwe.com (5.83.38.89) by MX1.PELLCITYSCHOOLS.NET
(10.0.0.15) with Microsoft SMTP Server id 14.3.169.1; Fri, 5 Sep 2014
14:12:00 -0500
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Ford Overstock <[email protected]>
Date: Fri, 5 Sep 2014 12:12:22 -0700
Subject: Rock-bottom discounts on 2014's
Message-ID: <2014090500594[e-mail]>
To: <[email protected]>
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: EXCHANGE01.PCSS.LOC
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: madbunwe.com
X-MS-Exchange-Organization-SenderIdResult: Pass
Received-SPF: Pass (EXCHANGE01.PCSS.LOC: domain of
[email protected]
designates 5.83.38.89 as permitted sender) receiver=EXCHANGE01.PCSS.LOC;
client-ip=5.83.38.89; helo=bawright.madbunwe.com;
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Organization-Antispam-Report: v=2.1 cv=aeNYw3Yt c=1 sm=1 tr=0
a=T8rIjO6mKJQ+94fJGo+fAg==:117 a=T8rIjO6mKJQ+94fJGo+fAg==:17
a=1zcUvo0hogkA:10 a=oS82QrVdJDkA:10 a=qE3gpJXiGUkA:10 a=kj9zAlcOel0A:10
a=E7ipFV9zAAAA:8 a=6YhcBzZrAAAA:8 a=8QrfYh5om_Q4riOErpgA:9
a=wWNLVvIxh3jk9zDA:21 a=I7hM4kbu4ljq4qH6:21 a=CjuIK1q_8ugA:10
a=bizVLaNEpWMA:10;OrigIP:5.83.38.89;SCL:-1
X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;1;0;0 0 0
Received: from macgroupus.wettrue.com (5.83.38.54) by MX1.PELLCITYSCHOOLS.NET
(10.0.0.15) with Microsoft SMTP Server id 14.3.169.1; Fri, 5 Sep 2014
13:33:23 -0500
Content-Type: text/html; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Message-ID: <2014090500262[e-mail]>
Date: Fri, 5 Sep 2014 11:33:46 -0700
Subject: Adjusted Home Payment, 2.99 Pct. Ready
To: <[email protected]>
From: Home Payment-Reduction <[email protected]>
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: EXCHANGE01.PCSS.LOC
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: wettrue.com
X-MS-Exchange-Organization-SenderIdResult: Pass
Received-SPF: Pass (EXCHANGE01.PCSS.LOC: domain of
[email protected] designates 5.83.38.54 as permitted sender)
receiver=EXCHANGE01.PCSS.LOC; client-ip=5.83.38.54;
helo=macgroupus.wettrue.com;
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Organization-Antispam-Report: v=2.1 cv=aeNYw3Yt c=1 sm=1 tr=0
a=OWV+kUdfH3dG0gKaIM7UEA==:117 a=OWV+kUdfH3dG0gKaIM7UEA==:17
a=nkEXP-9RdN8A:10 a=j8_Z_fWWQ6cA:10 a=0-XR6fN9bSAA:10 a=kj9zAlcOel0A:10
a=M_il8B12AAAA:8 a=6YhcBzZrAAAA:8 a=8HlGpp5ipwlAm3L7SP0A:9
a=TetN-Dxqk35B8DMb:21 a=CjuIK1q_8ugA:10 a=_W_S_7VecoQA:10
a=F7vr65HLMrMA:10;OrigIP:5.83.38.54;SCL:-1
X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;1;0;0 0 0
Received: from novackmacey.adenclear.com (5.83.38.22) by
MX1.PELLCITYSCHOOLS.NET (10.0.0.15) with Microsoft SMTP Server id 14.3.169.1;
Fri, 5 Sep 2014 12:42:52 -0500
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
To: <[email protected]>
Reply-To: <[email protected]>
From: Massive Wood-Project Database <[email protected]>
Message-ID: <DK[e-mail]>
Subject: Download over 10,000 Father/Son projects
Date: Fri, 5 Sep 2014 10:43:14 -0700
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: EXCHANGE01.PCSS.LOC
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: novackmacey.adenclear.com
X-MS-Exchange-Organization-SenderIdResult: Pass
Received-SPF: Pass (EXCHANGE01.PCSS.LOC: domain of
[email protected] designates 5.83.38.22 as permitted sender)
receiver=EXCHANGE01.PCSS.LOC; client-ip=5.83.38.22;
helo=novackmacey.adenclear.com;
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Organization-Antispam-Report: v=2.1 cv=aeNYw3Yt c=1 sm=1 tr=0
a=v8PoIBesxqQR6kEepLZJ7g==:117 a=v8PoIBesxqQR6kEepLZJ7g==:17
a=rid0MFnRnVQA:10 a=TbDVZEha78UA:10 a=G9qHhN7WPskA:10 a=RUD0_apYOI4A:10
a=kj9zAlcOel0A:10 a=J9u9LQjwAAAA:8 a=6YhcBzZrAAAA:8 a=7uVIZRh44UQICufYe1YA:9
a=CjuIK1q_8ugA:10 a=ZN73Z-vY58wA:10 a=DGAAHIZb5w8A:10
a=MpIORKB7RiAA:10;OrigIP:5.83.38.22;SCL:-1
X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;1;0;0 0 0
Jeff Green MCSA/MCSE 2003, MCITP 2008

Answer 1

Hi,
You could have a look on the following blogs.
Exchange Server 2010 : Planning for Anti-Spam (part 2)
http://mscerts.programming4.us/application_server/exchange%20server%202010%20%20%20planning%20for%20anti-spam%20(part%202).aspx#eYjWBhtXuiPZ7xfF.99
Note: Microsoft provides third-party contact information to help you find technical support. This contact
information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
Please make sure the bypass is configured correctly on the receive connectors.
http://blogs.technet.com/b/msfss_stuff/archive/2011/12/01/fpe-issue-where-all-spam-is-missed.aspx
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.