I've been having an odd issue lately (started within the past week) with the spam filtering on certain user mailboxes within my organization, where legitimate emails are being mistakenly moved into the spam folder. A few details:
- This happens with both external and internal emails sent to the affected users, but more often from internal.
- Affected mailboxes have no inbox or transport rules in place, and neither does the organization as a whole (checked via Powershell). There are also no safe or blocked domains or addresses of any kind, all have been removed. I tried adding the users whos messages were going to spam to the safe list, but that didn't change anything.
- I have tested using only the OWA on both ends (sending and receiving) and the problem persists, so I do not believe the issue lies within the Outlook clients (on either end).
- After viewing the message header details of the false positives, as far as I can tell everything indicates that the messages are not flagged as spam. (X-Forefront-Antispam-Report indicates SFV:NSPM and SCL:-1 or 1, both of which are below default spam level thresholds). Even turning off junk email filtering entirely (on both Outlook client and OWA) does not solve the issue.
- The messages arrive in the affected user's inbox without the [Spam] tag and stay for a couple seconds, and then are automatically moved to the spam folder and have the [Spam] tag added to the subject line.
- This only seems to happen when there is a JPG file in the email somewhere, whether its embedded or attached does not matter. Our organization's signature has a JPG in it, so I think that was causing it some of the time, but even without the signature an attached JPG file will also trigger the spam filtering.
- We do not run any sort of third party anti spam software that I know of.
I have tried everything I can think of and am at my wits end. I'm led to believe that this issue may have been caused by Microsoft (or other party) changes to the O365 Exchange environment, but I have no way to verify that and am not keen to sit and wait hoping it will fix itself...
I can provide any further necessary details or reports, just let me know what is needed. Any help is greatly appreciated...
Thanks!
Nick