Internal spam in Office 365 - Introduction | Part 3#17

of 18 | Internal spam in Office 365 - Introduction | Part 3#17
Written by Eyal Doron | o365info.com
INTERNAL SPAM IN OFFICE 365 –
INTRODUCTION | PART 3#17
In the article, we will review:
 What are the possible reasons that could cause to our mail to
appear as spamjunk mail?
 Who or what are this “elements”, that can decide that our mail is
a spam mail?
 What are the possible “reactions” of the destination mail
infrastructure that identify our E-mail as spamjunk mail?

Why is my mail identified as spam?
In a scenario in which our mail is recognized as a spamjunk mail,
besides of the unpleasant feeling (nobody wants that the term: “junk”
will be associated with him in any way), the major question is: Why is
my mail identified as spam?
The answer is that there could be many elements and “causes: for
this problem and that many times it’s not so easy to “point at” the
specific element that is “guilty” for our problem.

Our mission should be:
1. Learn to know each of the “elements” could lead us into a scenario in
which our E-mail will be recognized as a spamjunk mail by another
recipient.
2. Ensure that our organization users implement the best practices and,
avoid actions that could lead to a scenario in which organization mail
will be classified as spam.
3. Monitor our organization mail flow looking for a “problematic mail
items” or, event that could lead to a scenario in which our mail will be
classified as spam.
4. In the worst-case scenario in which the event of “organization mail is
classified as
“spamjunk mail” implement the required actions to solve this issue.

Who could decide that my mail is a spam mail?
1. Exchange Online
In the Office 365 environment, the first element in the “mail flow”
that could identify a specific Office 365 user E-mail message as a
spamjunk mail, is the Exchange Online by himself.
If we want to be more accurate, the element the scan the sent E-mail
is the component named: Exchange Online protection.
At first look this “behavior” look a little strange because most of the
time, we are used to a scenario in which the destination mail server
can identify our mail as spamjunk mail and not “our mail server”.

The reason for using internal outbound spam filtering mechanism
in Office 365 and Exchange Online environment is the Exchange
Online infrastructure is a “shared mail infrastructure”, that serve at
the same time many Office 365 customers (tenants) beside of our
organization.
Office 365 Infrastructure, is taking extra care to avoid a very
unwanted scenarios in which, a specific problematic organization
that is hosted at Office 365 will “damage” the reputation of other
organizations that is hosted at the same Office 365 Exchange Online
infrastructure.
Exchange Online include a built-in mechanism in which he checks
every outbound mail that is sent by Office 365 users to another
Office 365 users or external recipient.
In case that Exchange Online “decides” to classify specific E-mail
messages as spam mail, he doesn’t block or delete the E-mail
message and doesn’t update the SCL value of the E-mail message,
but instead, route the E-mail message to a dedicated Exchange
Online mail server named: High Risk Delivery Pool
Note – We will discuss in more details the subject of- High Risk
Delivery Pool in the articles:
 High Risk Delivery Pool and Exchange Online | Part 9#17
 High Risk Delivery Pool and Exchange Online | Part 10#17
2. Destination mail infrastructure | Mail Security Gateway
The “destination mail infrastructure” could be realized as: a device
that examines each incoming mail and decides whether to pass the
E-mail message, block or increase the SCL value.

In a scenario in which we notified that E-mail that was sent from
organization consider as – a spamjunk mail, the common case is
that our organization appears as blacklisted (registered at some
Blacklist provider).
In the modern mail environment, every organization uses some
“security mechanism” (mail security gateway or other security
solutions) that scan each of the connection requests that are sent to
the organization’s mail server.
The “requester” (source mail server) is checked and, only if the
connection request considers as “legitimate” to “mail session” is
approved.
The “verification process” that is implemented by the mail security
gateway, is implemented by using different methods, but one of the
most basic security cheeks is implemented by accessing a database
of “blacklist provider” and verifies that the recipient domain name or
the IP address of the mail server doesn’t appear as listed in a
blacklist.
3. User mail client
Mail clients such as Outlook, include built-in security engine that can
classify incoming mail as a spamjunk mail. For example, we can deal
with a scenario, in which specific E-mail message that was sent from
our users was identified as spamjunk mail by the Outlook client and
not by the external recipient mail server.
Another option could be a scenario in which the external recipient
uses the option of block senders and adds the E-mail address of
specific organization users to the list.
4. The destination recipient

The “person” that our mail is sent to his mailbox can decide to form
some reason to report our E-mail message as a spamjunk mail.
For example: recipient register to your mailing list in the past, forget
that he registered and, when he get E-mail from your organization,
he relates to the specific E-mail as spamjunk mail.
5. Desktop security application
Antivirus or other desktop security application can be configured to
scan incoming E-mail and decide to classify specific E-mail messages
as spamjunk mail.
What could happen in the case that my mail
recognizes as spamjunk mail?
In a scenario in which our E-mail recognizes as spamjunk mail by a
destination server, there is considerable importance for the external
mail server response.
In case that the external mail server responds by – sending a “reply”
in a form of NDR message, that informs us that our mail was blocked
because our mail is spamjunk mail, we are able to be aware of the
problem and respond respectively.
In a scenario in which the external mail server decides “not to
respond”, technically, we have no way to know that there is some
problem with E-mail that is sent from our organization.
The only way that we can be aware of the problem is – in a scenario
in which the external mail server “forward” the E-mail message to the
destination recipient and because the email server increases the SCL
value, the E-mail is sent to the junk mail folder.

Only if the “destination recipient” fined the E-mail in the junk mail
folder and, only if he is “kind enough” to inform us, only then, we can
know that we have a problem with mail that is sent from our
organization.
When our E-mail is accepted by an external mail server and, the
external mail server identifies our mail as “spamjunk mail”, the
external mail server could implement one of the following options:

Option 1: Block the E-mail message + inform the source mail server
that the E-mail message was blocked.
This scenario makes our life easier. Is truth that the Office 365
recipients E-mail didn’t get to his destination but, we have a “clear
indication” for the failure of the mail delivery.
Now, our mission will be: to find what was the reason for classifying
our E-mail message as spamjunk mail.
Option 2: Block the E-mail message + do not notify the source mail
server (silent drop)

A scenario in which the “destination mail server” classifies the E-mail
message as spamjunk mail and, just deletes the E-mail message
without sending any notification or update to the “source” that sends
the E-mail message.
Option 3: Deliver the E-mail message to the destination recipient +
Increase the SCL value
This type of scenario is the “standard” or the default behavior in
Exchange Online environment.
In case that the E-mail message is recognized as a spam mail and the
“spam level” is “reasonable”, Exchange Online will not block or delete
the spam mail, but instead, “stamp” the E-mail message with a high
value of SCL (spam confidence level) and, deliver the E-mail message
to the destination recipient.
The destination recipient” will have to decide “what to do with the E-
mail message”.

In this scenario, the E-mail message will get to the user “Junk mail
folder”, and most of the time; users do not tend to look at the junk
mail folder.
In this scenario the “destination recipient” will usually reports, that he
didn’t get the E-mail message, but the E-mail message is “hidden” in
his Junk mail folder.
Option 4: Deliver the E-mail message to a quarantine queue
A scenario that is similar to the former scenario. The difference is
that the Mail server delivers the E-mail message that was identified
as spam to a special store named: quarantine.
Option 5: The mail server doesn’t recognize the E-mail message as
spam but, the mail client does.
Many mail clients such as Outlook, considers as a sophisticated mail
client and has built-in options for recognizing spam mail, create a
block sender list, etc.
In this scenario, there is a chance that the mail client will decide that
a specific E-mail message can be considered as – a spam E-mail
message.
Exchange Online and SCL
In the current article series, we will mention from time to time the
term: SCL
Q: What is the meaning of SCL?
A: The term SCL, stand for Spam Confidence Level

In simple words, the SCL is a value that is “attached” by the mail
server (usually Exchange server) to a specific E-mail item and define
the “trust level” of the specific E-mail item from the perspective of:
spam.
An SCL value such as: “-1” is “saying” that the E-mail item can be fully
trusted and a high SCL value such as: 5, “say” that the specific E-mail
item considers as spam mail.
 Spam Confidence Level Threshold
 Outlook unexpectedly marks messages as junk even if the SCL level is
lowSpam Confidence Levels
 Spam Confidence Level
 Junk email with an SCL rating of 5 goes to the inbox
 Configure content filter policies
 Messages aren’t quarantined when you change the SCL rating in Office
365 or Exchange Online Protection
 Exposing SCL (Spam Confidence Level) in Outlook

Internal outbound spam in Office 365
environment | Article series index
A quick reference for the article series
My E-mail appears as a spam | Article
series index | Part 0#17
The article index of the complete
article series
Introduction to the concept of internal outbound spam in general
and in Office 365 and Exchange Online environment
My E-mail appears as a spam –
Introduction | Office 365 | Part 1#17
The psychological profile of the
phenomenon: “My E-mail appears as
a spam!”, possible factors for causing
our E-mail to appear a “spam mail”,
the definition of internal outbound
spam.
Internal spam in Office 365 –
Introduction | Part 2#17
Review in general the term: “internal
outbound spam”, miss conceptions
that relate to this term, the risks that
are involved in this scenario,
outbound spam E-mail policy and
more.

Internal spam in Office 365 –
Introduction | Part 3#17
What are the possible reasons that
could cause to our mail to appear as
spamjunk mail, who or what are this
“elements”, that can decide that our
mail is a spam mail?, what are the
possible “reactions” of the destination
mail infrastructure that identify our E-
mail as spamjunk mail?.
Commercial E-mail – Using the right
tools | Office 365 | Part 4#17
What is commercial E-mail?
Commercial E-mail as part of the
business process. Why do I think that
Office 365 Exchange Online is
unsuitable for the purpose of
commercial E-mail?
Introduction if the major causes for a scenario in which your
organization E-mail appears as spam
My E-mail appears as spam | The 7
major reasons | Part 5#17
Review three major reasons, that
could lead to a scenario, in which E-
mail that is sent from our
organization identified as spam mail:
1. E-mail content, 2. Violation of the
SMTP standards, 3. BulkMass mail

My E-mail appears as spam | The 7
major reasons | Part 6#17
Review three major reasons, that
could lead to a scenario, in which E-
mail that is sent from our
organization identified as spam mail:
4. False positive, 5. User Desktop
malware, 6. “Problematic” Website
Introduction if the subject of SPF record in general and in Office
365 environment
What is SPF record good for? | Part
7#17
The purpose of the SPF record and the
relation to for our mail infrastructure.
How does the SPF record enable us to
prevent a scenario in which hostile
elements could send E-mail on our
behalf.
Implementing SPF record | Part 8#17
The “technical side” of the SPF record:
the structure of SPF record, the way
that we create SPF record, what is the
required syntax for the SPF record in
an Office 365 environment + mix mail
environment, how to verify the
existence of SPF record and so on.

Introduction if the subject of Exchange Online - High Risk Delivery
Pool
High Risk Delivery Pool and Exchange
Online | Part 9#17
How Office 365 (Exchange Online) is
handling a scenario of internal
outbound spam by using the help of
the Exchange Online- High Risk
Delivery Pool.
High Risk Delivery Pool and Exchange
Online | Part 10#17
The second article about the subject
of Exchange Online- High Risk
Delivery Pool.
The troubleshooting path of internal outbound spam scenario
My E-mail appears as spam –
Troubleshooting path | Part 11#17
Troubleshooting scenario of internal
outbound spam in Office 365 and
Exchange Online environment.
Verifying if our domain name is
blacklisted, verifying if the problem is
related to E-mail content, verifying if
the problem is related to specific
organization user E-mail address,
moving the troubleshooting process
to the “other side.

My E-mail appears as spam |
Troubleshooting – Domain name and
E-mail content | Part 12#17 Verify if
our domain name appears as
blacklisted, verify if the problem
relates to a specific E-mail message
content, registering blacklist
monitoring services, activating the
option of Exchange Online outbound
spam.
Troubleshooting – Mail server | Part
13#17
What is the meaning of: “our mail
server”?, Mail server IP, host name
and Exchange Online. One of our
users got an NDR which informs him,
that his mail server is blacklisted!,
How do we know that my mail server
is blacklisted?
14#17
The troubleshooting path logic. Get
the information from the E-mail
message that was identified as
spamNDR. Forwarding a copy of the
NDR message or the message that
saved to the junk mail

15#17
Step B – Get information about your
Exchange Online infrastructure, Step
C – fetch the information about the
Exchange Online IP address, Step D –
verify if the “formal “Exchange Online
IP address a
De-list your organization from a
blacklist | My E-mail appears as spam
| Part 16#17
Review the charters of a scenario in
which your organization appears as
blacklisted. The steps and the
operations that need to be
implemented for de-list your
organization from a blacklist.
Summery and recap of the troubleshooting and best practices in a
scenario of internal outbound spam
Dealing and avoiding internal spam |
Best practices | Part 17#17
Provide a short checklist for all the
steps and the operation that relates
to a scenario of – internal outbound
spam.

Internal spam in Office 365 - Introduction | Part 3#17

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (16)

More from Eyal Doron

More from Eyal Doron (20)

Internal spam in Office 365 - Introduction | Part 3#17