Advanced Spam Filter (ASF) settings in EOP
Applies to
- Exchange Online Protection
- Microsoft Defender for Office 365 plan 1 and plan 2
- Microsoft 365 Defender
In all Microsoft 365 organizations, the Advanced Spam Filter (ASF) settings in anti-spam policies in EOP allow admins to mark messages as spam based on specific message properties. ASF specifically targets these properties because they're commonly found in spam. Depending on the property, ASF detections will either mark the message as Spam or High confidence spam.
Note
Enabling one or more of the ASF settings is an aggressive approach to spam filtering. You can't report messages that are filtered by ASF as false positives. You can identify messages that were filtered by ASF by:
- Periodic quarantine notifications from spam and high confidence spam filter verdicts.
- The presence of filtered messages in quarantine.
- The specific
X-CustomSpam:
X-header fields that are added to messages as described in this article.
The following sections describe the ASF settings and options that are available in anti-spam policies in the Microsoft 365 Defender portal, and in Exchange Online PowerShell or standalone EOP PowerShell (New-HostedContentFilterPolicy and Set-HostedContentFilterPolicy). For more information, see Configure anti-spam policies in EOP.
Enable, disable, or test ASF settings
For each ASF setting, the following options are available in anti-spam policies:
On: ASF adds the corresponding X-header field to the message, and either marks the message as Spam (SCL 5 or 6 for Increase spam score settings) or High confidence spam (SCL 9 for Mark as spam settings).
Off: The ASF setting is disabled. This is the default value, and we recommend that you don't change it.
Test: ASF adds the corresponding X-header field to the message. What happens to the message is determined by the Test mode (TestModeAction) value:
- None: Message delivery is unaffected by the ASF detection. The message is still subject to other types of filtering and rules in EOP.
- Add default X-header text (AddXHeader): The X-header value
X-CustomSpam: This message was filtered by the custom spam filter option
is added to the message. You can use this value in Inbox rules or mail flow rules (also known as transport rules) to affect the delivery of the message. - Send Bcc message (BccMessage): The specified email addresses (the TestModeBccToRecipients parameter value in PowerShell) are added to the Bcc field of the message, and the message is delivered to the additional Bcc recipients. In the Microsoft 365 Defender portal, you separate multiple email addresses by semicolons (;). In PowerShell, you separate multiple email addresses by commas.
Notes:
- Test mode is not available for the following ASF settings:
- Conditional Sender ID filtering: hard fail (MarkAsSpamFromAddressAuthFail)
- NDR backscatter(MarkAsSpamNdrBackscatter)
- SPF record: hard fail (MarkAsSpamSpfRecordHardFail)
- The same test mode action is applied to all ASF settings that are set to Test. You can't configure different test mode actions for different ASF settings.
Increase spam score settings
The following Increase spam score ASF settings set the spam confidence level (SCL) of detected messages to 5 or 6, which corresponds to a Spam filter verdict and the corresponding action in anti-spam policies.
Anti-spam policy setting | Description | X-header added |
---|---|---|
Image links to remote websites IncreaseScoreWithImageLinks |
Messages that contain <Img> HTML tag links to remote sites (for example, using http) are marked as spam. |
X-CustomSpam: Image links to remote sites |
Numeric IP address in URL IncreaseScoreWithNumericIps |
Messages that contain numeric-based URLs (typically, IP addresses) are marked as spam. | X-CustomSpam: Numeric IP in URL |
URL redirect to other port IncreaseScoreWithRedirectToOtherPort |
Message that contain hyperlinks that redirect to TCP ports other than 80 (HTTP), 8080 (alternate HTTP), or 443 (HTTPS) are marked as spam. | X-CustomSpam: URL redirect to other port |
Links to .biz or .info websites IncreaseScoreWithBizOrInfoUrls |
Messages that contain .biz or .info links in the body of the message are marked as spam. |
X-CustomSpam: URL to .biz or .info websites |
Mark as spam settings
The following Mark as spam ASF settings set the SCL of detected messages to 9, which corresponds to a High confidence spam filter verdict and the corresponding action in anti-spam policies.
Anti-spam policy setting | Description | X-header added |
---|---|---|
Empty messages MarkAsSpamEmptyMessages |
Messages with no subject, no content in the message body, and no attachments are marked as high confidence spam. | X-CustomSpam: Empty Message |
Embedded tags in HTML MarkAsSpamEmbedTagsInHtml |
Message that contain <embed> HTML tags are marked as high confidence spam. This tag allows the embedding of different kinds of documents in an HTML document (for example, sounds, videos, or pictures). |
X-CustomSpam: Embed tag in html |
JavaScript or VBScript in HTML MarkAsSpamJavaScriptInHtml |
Messages that use JavaScript or Visual Basic Script Edition in HTML are marked as high confidence spam. These scripting languages are used in email messages to cause specific actions to automatically occur. |
X-CustomSpam: Javascript or VBscript tags in HTML |
Form tags in HTML MarkAsSpamFormTagsInHtml |
Messages that contain <form> HTML tags are marked as high confidence spam. This tag is used to create website forms. Email advertisements often include this tag to solicit information from the recipient. |
X-CustomSpam: Form tag in html |
Frame or iframe tags in HTML MarkAsSpamFramesInHtml |
Messages that contain <frame> or <iframe> HTML tags are marked as high confidence spam. These tags are used in email messages to format the page for displaying text or graphics. |
X-CustomSpam: IFRAME or FRAME in HTML |
Web bugs in HTML MarkAsSpamWebBugsInHtml |
A web bug (also known as a web beacon) is a graphic element (often as small as one pixel by one pixel) that's used in email messages to determine whether the message was read by the recipient. Messages that contain web bugs are marked as high confidence spam. Legitimate newsletters might use web bugs, although many consider this an invasion of privacy. |
X-CustomSpam: Web bug |
Object tags in HTML MarkAsSpamObjectTagsInHtml |
Messages that contain <object> HTML tags are marked as high confidence spam. This tag allows plug-ins or applications to run in an HTML window. |
X-CustomSpam: Object tag in html |
Sensitive words MarkAsSpamSensitiveWordList |
Microsoft maintains a dynamic but non-editable list of words that are associated with potentially offensive messages. Messages that contain words from the sensitive word list in the subject or message body are marked as high confidence spam. |
X-CustomSpam: Sensitive word in subject/body |
SPF record: hard fail MarkAsSpamSpfRecordHardFail |
Messages sent from an IP address that isn't specified in the SPF Sender Policy Framework (SPF) record in DNS for the source email domain are marked as high confidence spam. Test mode is not available for this setting. |
X-CustomSpam: SPF Record Fail |
The following Mark as spam ASF settings set the SCL of detected messages to 6, which corresponds to a Spam filter verdict and the corresponding action in anti-spam policies.
Anti-spam policy setting | Description | X-header added |
---|---|---|
Sender ID filtering hard fail MarkAsSpamFromAddressAuthFail |
Messages that hard fail a conditional Sender ID check are marked as spam. This setting combines an SPF check with a Sender ID check to help protect against message headers that contain forged senders. Test mode is not available for this setting. |
X-CustomSpam: SPF From Record Fail |
Backscatter MarkAsSpamNdrBackscatter |
Backscatter is useless non-delivery reports (also known as NDRs or bounce messages) caused by forged senders in email messages. For more information, see Backscatter messages and EOP. You don't need to configure this setting in the following environments, because legitimate NDRs are delivered, and backscatter is marked as spam:
In standalone EOP environments that protect inbound email to on-premises mailboxes, turning this setting on or off has the following result:
Test mode is not available for this setting. |
X-CustomSpam: Backscatter NDR |
Feedback
Submit and view feedback for