KB - How to redirect blacklisted emails to the Junk folder (Exchange 2003)

How to redirect blacklisted emails to the Junk folder (Exchange 2003)

Article was last updated on January 9, 2017. View products that this article applies to.


The following article provides step-by-step instructions to redirect all emails blacklisted by ORF to the recipients' Junk folder instead of rejecting them. This could be useful if your users wish to review blacklisted emails to make sure no legitimate email has been blocked.

This article is for Exchange 2003 SP2: if you have Exchange 2007 or later, follow the steps described in this KB article instead. Exchange 2013 users should consult this KB article.

Exchange Configuration

Enabling IMF (Intelligent Message Filtering)

  1. Start the Exchange System Manager
  2. Under Servers, expand your server
  3. Select Protocols, then SMTP
  4. Right click on your SMTP server and select Properties
  5. On the General tab, click the Advanced... button
  6. Select the SMTP port on which the mails are coming in (25 by default) and click the Edit button
  7. Finally, check the Apply Intelligent Message Filter check box and click OK.

Configuring the SCL thresholds

Next, IMF needs to be configured to move all emails with SCL score 8 or higher to the Junk folder of the recipient.

  1. Start the Exchange System Manager
  2. Select Global Settings > Message Delivery
  3. Right click on it and select Properties
  4. Select the Intelligent Message Filter tab

    There are two (quite confusing) threshold settings for the SCL scores: the Store Junk Email Configuration SCL threshold tells IMF which ones should be redirected to the Junk folder, while the Gateway Blocking Configuration threshold tells which ones should be rejected (or archived, depending on your settings).

    For example, if you set the Gateway Blocking Configuration threshold to 9 and the Store Junk Email Configuration to 6, the following will happen:

    • Emails with SCL score 0-6 will be delivered
    • Emails with SCL score 7-8 will be redirected to the Junk folder
    • Emails with SCL score 9 will be blocked
  5. Set 7 for Store Junk Email Configuration and 9 for Gateway Blocking Configuration.
  6. Since we want to redirect all messages to the Junk folder and reject none, you should choose No Action to be performed (When blocking messages:), so no email will be archived or rejected by IMF, all will go to the Junk folder (with SCL score higher than 7).

Configuring the Custom Weighting Feature (CWF)

We will use CWF to setup a manual rule which will set the SCL score to the maximum (9) for all emails blacklisted and tagged by ORF, so IMF will redirect them the Junk folder.

Enabling The Custom Weighting Feature

First, in order to enable CWF, we need to register the MSExchange.UceContentFilter.dll file in its folder (Program Files\Exchsrvr\bin\MSCFV2\ by default):

  1. Open a command prompt
  2. Navigate to the folder where the DLL file resides
  3. Issue the following command:

    regsvr32 MSExchange.UceContentFilter.dll

    You should receive a DllRegisterServer in MSExchange.UceContentFilter.dll succeeded message.

Creating the CWF configuration file

The Custom Weighting feature has no graphical user interface, the configuration is stored in an XML file called MSExchange.UceContentFilter.xml. The XML file is read by IMF upon initialization, and reloaded every time it is modified.

  1. Download our package file and save it to a temporary location
  2. Extract the MSExchange.UceContentFilter.xml file to the the same folder where the MSExchange.UceContentFilter.dll you registered earlier resides
  3. Restart the IIS SMTP service by running the command


ORF Configuration

  1. Start the ORF Administration Tool
  2. Expand Filtering / Tests in the left navigation pane
  3. Assign all blacklist tests to On Arrival
  4. Expand Filtering / Actions
  5. Click the Edit button under On Arrival and select Accept email and perform further actions
  6. Check Tag email subject with the text below and enter [SPAM]
  7. Click OK and save your settings by pressing Ctrl + S.

Changing the filtering order

The above method requires that ORF tags the email before CWF of IMF evaluates the email and assigns an SCL value. Please consult our KB article to ensure that ORF tests and tags incoming emails first.

If everything was configured properly, ORF will tag blacklisted emails, CWF will increase the SCL score of the tagged email to 9, and IMF will redirect it to the Junk folder of the target recipient.


The email subject is not tagged by ORF

SOLUTION: Make sure you configured everything in ORF correctly and the changes were applied. If it does not solve the problem, check the ORF logs to find out what happened: it's possible that the email was whitelisted for some reason.

The mail was tagged, but it was delivered to the user's Inbox instead of the Junk Email folder

SOLUTION: Make sure CWF increased the SCL score of the tagged email to 9. Unfortunately, the SCL score is not indicated anywhere in the email client, but with a little trick, you can create an SCL column in your Outlook view:

  1. Download our package file and save it to a temporary location
  2. Extract the scl.cfg file to the directory where IPML.ico and IPMS.ico reside (ProgramFiles\Microsoft Office\OFFICE11\FORMS\\ by default. For the English version, the language ID is 1033, for other versions this may differ).
  3. Open Outlook
  4. From the main menu, select Tools > Options > Other > Advanced Options > Custom Forms > Manage Forms
  5. Click on Install and select the scl.cfg file
  6. Install it into your Personal Forms Library
  7. Press OK repeatedly until you return to the main Outlook screen
  8. Right-click on the column headings in your Inbox (or any other folder) and select Customize Current View...
  9. Click Fields...
  10. In Select available fields, scroll down and choose Forms
  11. Under Personal Forms, choose the SCL Extension Form, click Add, then Close

Now you have an SCL column displaying the SCL rating of messages. Drag the SCL column where you want it.

The emails are tagged and have the maximum SCL score (9), still, they are delivered to the user's Inbox instead of the Junk E-mail folder.

SOLUTION: This may happen because Outlook does not use the IMF provided SCL values for its client-side (cached-mode only) anti-spam determination. Instead, it does its own Junk E-mail evaluation and determines whether or not to move the mail to the Junk E-mail folder based on its own settings. You can read more about the problem on this website.

The problem seems to affect mostly those mailboxes which were not fired up in Exchange cache mode at first. If the problem appears to affect only a few mailboxes, you can do the following:

  1. Login to the mailbox using Outlook Web Access (OWA)
  2. Check the Filter Junk E-mail. Check the Junk E-mail folder regularly to ensure that you do not miss messages that you want to receive checkbox in Options
  3. Click Save & Exit

This will fix the Junk folder issue in both in Outlook and OWA. Sometimes poking the Junk E-mail settings in Outlook might also help. If you have many mailboxes with this problem, you should use Evan Dodds' script to set this for multiple mailboxes at once.

I have multiple subfolders in Program Files\Exchsrvr\bin\MSCFV2 with different MSExchange.UceContentFilter.dll files in each. Where should I put the XML file?

SOLUTION: Exchange Updates create new folders for each new version of CWF. You can use either of them, just make sure you save the XML file to the same folder where the DLL you registered with regsvr32 resides.

The Custom Weighting List does not seem to be working and I have error messages (error 7514) in the Event Log saying “An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80004005.”

SOLUTION: Such issue may occur if you edit the XML configuration file and save it in ANSI instead of Unicode (or in a different Unicode format). The quickest way to verify this is trying to load it in Internet Explorer. If you get a Cannot view XML input using style sheet error, then it was probably saved in the wrong format. Re-save it in Unicode in your text editor.

No mail arrives to the users' mailboxes.

SOLUTION: Make sure you have set No Action in Gateway Blocking Configuration, otherwise IMF will archive or block all emails tagged by ORF.

Emails are tagged by ORF, but they arrive to the users' inboxes instead of the Junk folder.

SOLUTION: Make sure the filtering order and priorities are configured correctly.

Applies To

The article above is not specific to any ORF versions.

hnp1 | hnp2