Mark Berry September 13, 2011
Since moving to Office 365, I’ve been having trouble getting Outlook to treat mail from my own address as safe. Mail sent from my own address (e.g. from server monitoring scripts) keeps landing in my Junk E-Mail folder.
The obvious solution would seem to be adding the sending email address to the Safe Senders list in Outlook. But whenever I did that, after a short while, it would disappear again. Then when I tried it from OWA, I got this message: “’User01@mydmain.com’ is your e-mail address or domain and can’t be added to your Safe Senders and Recipients list.”
Unfortunately there is no Why Not? button, and when I followed Click here for help, no help was available for Error ID: Ex60EC60.
Forefront and SPF Changes
I thought maybe if Forefront cleared the mail, it would be accepted by Outlook. With the help of Forefront support, I set up my third-party SMTP server’s IP address as a permitted Inbound Connector, setting Spam Filtering: Disabled.
At the suggestion of Forefront support, I also added the SMTP server’s IP address to the SPF record at my domain host.
In the email headers, I see
X-Safelisted-IP: <SMTP server IP> and
Received-SPF: pass, confirming that these changes are working. In fact, if Outlook is not running on my desktop, the mail is not treated as junk (as viewed in OWA). But as soon as I start Outlook, the mail is moved to Junk E-Mail.
Exchange 2010 Blocks Safe Senders
The Exchange Team published this article that explains the problem: Exchange 2010 doesn’t allow adding your own domain to the Safe Senders list. The article says you can add your own email address, but in Office 365, even that is not allowed. The article also says to use
Add-IPAllowListEntry to configure safe IPs, but that command is not supported by Office 365.
Force Spam Confidence Level
The article does hint at a workaround: if the Spam Confidence Level (SCL) of the email is –1, Outlook will not treat it is spam.
Currently the SCL on the email that Outlook is treating as junk is 0:
MS Partner Support provided the command that I needed to force the SCL to –1:
New-TransportRule. First, start PowerShell and connect to Office 365. Then run commands like this (copy to Notepad to edit and eliminate line breaks):
# List transport rules
# Add transport rule
New-TransportRule -Name "Allow User01@mydomain.com" -Comments "Force SCL -1 on mail from User01@mydomain.com so Outlook will not move to Junk E-Mail" -FromAddressContainsWords "User01@mydomain.com" -SetSCL -1
# List transport rules
# List new transport rule details
Get-TransportRule "Allow User01@mydomain.com" | Format-List
After running the
New-TransportRule command, the SCL was in fact set to –1, and the mail no longer landed in the Junk E-Mail folder.
Note According to MS Partner Support, I could actually create a rule for my entire domain:
New-TransportRule -Name "Allow mydomain.com" -FromAddressContainsWords "mydomain.com" -SetSCL -1
Since adding the entire domain could potentially allow spammers to use spoofed headers, I decided to just go with the single address.
Update December 13, 2011
I’ve discovered that you can view the spam confidence rules from within the Outlook web app:
- From the Office 365 Admin Overview page, under Exchange Online, click on Manage.
- On the Exchange Server 2010 options, page, make sure it says Options: Manage My Organization at the top.
- In the left column, click on Mail Control.
- Make sure the Rules tab is shown.
- Highlight each rule to see the conditions and action in the right column.
You can delete rules here, and probably even add conditions to a rule. Unfortunately, you cannot create a new rule for setting the Spam Confidence Level—that’s not one of the options in the drop-down list when creating a rule.