Do not bypass spam filtering for sender domains in mail flow rules

Description

No Exchange mail flow rule (transport rule) sets the spam confidence level to Bypass spam filtering (SetSCL -1) based on the sender domain (SenderDomainIs, FromAddressContains, FromAddressMatchesPatterns). This applies above all to the organization's own accepted domains.

A rule that sets SCL -1 is acceptable only when it is tied to a condition the sender cannot forge, such as the connector or IP address of a known system (SenderIpRanges), and it is documented. Legitimate senders that are wrongly filtered are handled with the Tenant Allow/Block List, the spoof intelligence insight or the advanced delivery policy.

Rationale

The From and envelope domains are trivial to forge. A rule that trusts a sender domain lets every spoofed message from that domain skip spam, bulk and part of the phishing filtering. Allow-listing the organization's own domain is the worst case: an outsider can then send mail that looks internal to any employee.

Impact

Messages from the formerly listed partners go through normal filtering again and some may land in Junk Email until the sender fixes its SPF, DKIM and DMARC or an allow entry is created in the Tenant Allow/Block List.

Audit

1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a Global Reader.
2. Browse to Mail flow > Rules and open every enabled rule.
3. Look for rules whose action is Modify the message properties > Set the spam confidence level (SCL) > Bypass spam filtering and whose condition is on the sender's domain or address.
4. In Exchange Online PowerShell (read-only):

   Get-TransportRule | Where-Object { $_.SetSCL -eq -1 } |
     Format-List Name, State, Priority, SenderDomainIs, FromAddressContainsWords, FromAddressMatchesPatterns, SenderIpRanges
   

5. Fail if an enabled rule sets SCL -1 with a sender domain or address condition, and always if the listed domain is one of the organization's accepted domains (Get-AcceptedDomain).

Remediation

1. For each offending rule, note why it was created (which partner, which false positive).
2. Replace it: report the false positive to Microsoft from Actions & submissions > Submissions, add an allow entry in Tenant Allow/Block Lists if needed, or, for an internal system, restrict the rule to the system's IP range or inbound connector.
3. In the Exchange admin center, browse to Mail flow > Rules, select the rule and turn it off; delete it once the replacement is tested.
4. PowerShell equivalent (Exchange Administrator):

   Disable-TransportRule -Identity "<rule name>"
   Remove-TransportRule -Identity "<rule name>"
   

Rollback

Turn the rule back on (Enable-TransportRule) while the replacement is being set up.

References

• Mail flow rules (transport rules) in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
• Create safe sender lists in EOP Microsoft, vendor-doc, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-118-2, ORCA-118-4) Microsoft (community project), tool, accessed 2026-10-24
• Maester MT.1043 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-030 Apply the recommended inbound anti-spam actions with no allowed senders or domains
• related CB-M365-MAIL-032 Keep the connection filter IP allow list empty and the safe list off

People and lifecycle