Anti Spam Policy Issue

Question

I have a few users who are experiencing an issue with suspected spam being forwarded to a mailbox that no longer exists. I can't find the right place to disable this rule.

In the header of the message I see the following:

x-ms-exchange-antispam-duplicateemailtocustommailbox: true

I am suspecting this is the culprit that I need to disable. But I can't find any documentation on this attribute. I've checked our policies in Defender and none of them relate to this kind of setting.

Any insight would be appreciated.

Answer 1

Check your Outbound anti-spam policies and specifically the "Send a copy of suspicious outbound messages or message that exceed these limits to these users and groups" setting. Details are here if you need them: https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-configure

Answer 2

It's under Email & Collaboration -> User Reported Settings.

What's happening is the user is reporting the email as not spam and those messages were being forwarded to an internal mailbox for some reason.

Answer 3

Hello, @J Allan,

Welcome to the Microsoft Q&A platform!

Based on your description, I understand that some of your users are experiencing a strange rule of suspected spam being forwarded to non-existent mailboxes and you want to disable this rule.

From the portion of the email header you provided, it appears that this issue is related to the application of anti-spam policy.

According to your follow-up Comment, I could exclude the reason of applying anti-spam policy, then it is highly possible that the user has set up some customized mail flow rules and mail forwarding rules.

In order to resolve your issue, I need to confirm a few situations with you.

1. Are the emails being automatically forwarded all from the same sender or organization?
2. Are the auto-forwarded emails all sent to the same mailbox?

What I will give below is the way to check the auto-forwarding.

1.View mail flow rules in EAC that may forward mail to non-existent mailboxes. For more information and details, you could refer to this document: Manage mail flow rules in Exchange Online | Microsoft Learn.

2.Check the forwarding rules for the affected mailboxes by the following steps.

a. Sign in to the Outlook Web App using the affected user's account.

b. Click Settings in the upper right corner.

c. Select Mail>Forwarding.

d. If forwarding rules are found, disable or remove them as required.

I hope the documentation and methods I have provided will solve your problem. If not, in order to resolve your issue as quickly as possible, please respond to the questions I have posed to you at your leisure, as it will help me to follow up with you more effectively.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thank you for your support and understanding.

Best Wishes,

Alex Zhang