Preface

The following article provides step-by-step instructions to redirect all emails blacklisted by ORF to the recipients' Junk folder instead of rejecting them. This could be useful if your users wish to review blacklisted emails to make sure no legitimate email has been blocked.

This article is for Exchange 2007/2010: if you have Exchange 2003, follow the steps described in this KB article instead. Exchange 2013 users should consult this KB article.

Exchange Configuration

1. Start the Exchange Management Console
2. Expand Organization Configuration / Hub Transport and select the Transport Rules tab
3. Click on New Transport Rule in the Action pane
4. Name the rule (e.g. SCL of ORF-tagged emails). You can add a comment as well.
5. On the Conditions page, select the condition to trigger this rule: When the subject field contains specific words
6. Set the specific word to [SPAM] (the tag we will use in ORF)
7. On the Actions page, select the action Set the spam confidence level to value
8. In the rule description, click on the 0 link and add a value that’s above your SCLJunkThreshold, e.g., 9, and click Next
9. On the Exceptions page, click Next again
10. Click New, then click Finish.

ORF Configuration

1. Start the ORF Administration Tool and connect to the local or remote ORF instance
2. Expand Filtering / Actions
3. Click the Edit button under Default Action and select Accept & Modify
4. Check Tag email subject with the text below
5. In the Subject tag field, enter: [SPAM]
6. Click OK
7. Save the ORF configuration to apply the new settings (Ctrl + S).

Changing the filtering order

The above method requires that ORF tags the email before the Content Filter Agent evaluates the email and assigns an SCL value. Please consult our KB article to ensure that ORF tests incoming emails first.

The Content Filter Agent of Exchange may drop emails before they could reach the Junk folder. To ensure this does not happen, you can disable the Delete, Reject, and Quarantine actions of the Content Filter Agent using the following command using the Exchange Management Shell:

If everything was configured properly, ORF will tag blacklisted emails, the Transport Rule will increase the SCL score of the tagged email to 9, and it will land in the Junk folder of the target recipient.