If it's being marked as spam, and isn't, the recipient Office365 Tenant needs to raise it as a False Positive.
Or the sender, if it’s coming from Office365 to an external. One way or another, *SOMEONE* has to raise it as an FP. Aloha, Michael. -- Michael J Wise Microsoft Corporation| Spam Analysis "Your Spam Specimen Has Been Processed." Got the Junk Mail Reporting Tool<http://www.microsoft.com/en-us/download/details.aspx?id=18275> ? -----Original Message----- From: mailop <mailop-boun...@mailop.org> On Behalf Of Jethro R Binks Sent: Wednesday, February 7, 2018 4:00 AM To: mailop@mailop.org Subject: Re: [mailop] Spam originating from Office 365 On Tue, 6 Feb 2018, Carl Byington wrote: > On Mon, 2018-02-05 at 03:00 +0000, Shane Clay via mailop wrote: > > For our customers, the bulk majority of spam they actually receive > > (over 90% of whats delivered and more than 40% of whats blocked) now > > days comes from Office 365. Do others see these same trends? > > The percentage is not that high here, but are you using something to > reject mail containing SFV:SPM ? For example, spamassassin: > > header OPOC X-Forefront-Antispam-Report =~ /SFV\:SPM/ score OPOC 10 I lately asked about this on another mailing list, but didn't get response. Greatful for any views from this community: For some considerable time we've had a rule to increase the score in SpamAssassin based on whether the MS infrastructure it came to us through marked it as spam itself: # protection.outlook.com may determine that an (outbound?) message is spam and adds # to this header. Trust them. # https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftechnet.microsoft.com%2Fen-gb%2Flibrary%2Fdn205071(v%3Dexchg.150).aspx&data=04%7C01%7Cmichael.wise%40microsoft.com%7C580890a03f55433c289d08d56e23b819%7Cee3303d7fb734b0c8589bcd847f1c277%7C1%7C0%7C636536022054510463%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=hFmwGDByaTPunc4wUoDgpnS01d7YaMhVYuWZqNBUqVM%3D&reserved=0 header PROTECTIONOUTLOOK_MARKED_SPAM X-Forefront-Antispam-Report =~ /SFV\:SPM/ score PROTECTIONOUTLOOK_MARKED_SPAM 10.0 Now I've seen many cases where this is plainly successful. But I've also had queries for emails from "reputable" sites (including .ac.uk ones) which have also been marked in this, and thus highly scored at our end before delivery. So I'm wondering if something has changed and this isn't so reliable. At the moment, if I get an enquiry, I just make some comment along the lines that MS's infrastructure is closer to the sender, and is in a better position to evaluate whether a message is spam - we simply trust what they say, by virtue of the content in the X-Forefront-Antispam-Report header. Does anyone have any insight into whether this is a reasonable position to maintain now? . . . . . . . . . . . . . . . . . . . . . . . . . Jethro R Binks, Network Manager, Information Services Directorate, University Of Strathclyde, Glasgow, UK The University of Strathclyde is a charitable body, registered in Scotland, number SC015263. _______________________________________________ mailop mailing list mailop@mailop.org<mailto:mailop@mailop.org> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchilli.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailop&data=04%7C01%7Cmichael.wise%40microsoft.com%7C580890a03f55433c289d08d56e23b819%7Cee3303d7fb734b0c8589bcd847f1c277%7C1%7C1%7C636536022054520473%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=J2q1uFYf%2BB%2FX1lkXrlAMOlgEjdrSFR2fx%2BVB7iyhsW0%3D&reserved=0
_______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
