I created a transport rule similar to that by using the "when a message header contains specific words" condition. You then specify the header field -- most likely "From" in your case -- then enter the e-mail address(es) of the malicious sender as text. This keeps you from having to create a contact in your local Exchange org just for this purpose.
Dave Beauvais -- Dave W. Beauvais / Exchange and Systems Administrator Ohio University Office of Information Technology From: Peter Johnson [mailto:johnson.pet...@gmail.com] Sent: Wednesday, May 15, 2013 00:56 To: MS-Exchange Admin Issues Subject: Re: Transport Rule to forward email from specific sender to a mailbox Have you tried adding the email address as a contact first ? Sent on the run! On 15 May 2013, at 4:49, xyz <x...@minneapolis.edu<mailto:x...@minneapolis.edu>> wrote: Greetings, Exchange 2010 SP1 UR3. I have done this in the past, but not able to make work at the moment so not sure the issue on my end. I have found a specific SPAM sender with a known consistent email address per several tickets, so I want to forward all email from the internet sender to a specific mailbox for my review. Using EMC: When I create New Transport Rule – Conditions Step one – select conditions – click” from people” – Step 2 ––Edit the rule descriptions below in the same screen. When I click the link for people and click Add, it brings up the box for Select Recipient – Entire Forest with the scope picker, but all is shows are our internal email structure. I have not been able to figure out how to just bypass all the internal matters and ADD an external email address to identify the next conditions for said address. I must be missing something simple. Thanks for any comments or questions. Thanks for your help. Dana --- To manage subscriptions click here: or send an email to with the body: unsubscribe exchangelist --- To manage subscriptions click here: or send an email to with the body: unsubscribe exchangelist --- To manage subscriptions click here: or send an email to with the body: unsubscribe exchangelist
