BGfL 365 Spam filtering

[Alis_Klar]

Hi,

 

e-mail from users at our school are being flagged as Spam! This happens even in internal messages between users in the same school and domain!!

 

Link2ICT / BGfL must not know how to route mail throught a Spam filter properly. When they were using McAfee Click protect this also happened. Link2ICT said they cannot whitelist our school domain as it would allow spoofing.

 

But can't they look at the origin IP address and if its outside BGfL or not from Microsofts servers and it has an internal school domain it must be Spam!

 

This situation has continued now they are using the Cisco solution which lets many Phishing e-mail with dodgy links to get through.

[Michael]

I've not had any reports of schools on vanilla setups, even within the BGfL network, so it'd be interesting to know if other BGfL 365 schools have the same/similar issues.

 

I take it you don't have Global Admin rights, so it's entirely speculative as to what's going on?

[Chuckster]

Is your school in Sutton Coldfield?

 

I only ask because I have been receiving a lot of spam with the subject - Re: Governor Training Programme - Autumn 2015

[Alis_Klar]

I am on the BGfL365 tennant. They don't give out Global Admin rights do they. Would like to be able to use PowerShell stuff.

 

I know there has been an issue of lots of staff accounts being compromised from phishing and then used to send out more phishing e-mails from that account so perhaps they aren't whitlsiting internal domains for that reason.

 

It does have the side effect of many messages marked as with [sUSPECTED SPAM] in the subject line but they still get through without delay. So dunno what its for?

[Alis_Klar]

Just got this responce. Not bad for Link2ICT. Actually quite usefull.

 

It's for security, due to the amount of compromised accounts that are occurring due to phishing emails all email needs to be scanned.

Email flagged as suspected spam which is not spam can be reported to Cisco. To do this you need you need to do the following :-

 

Microsoft Outlook Web App, Microsoft Office 365

1.Open your mailbox in Microsoft Outlook Web App.

2.Select the message that you want to submit.

3.Click "New mail" at the top left.

4.Drag the message you are submitting over, and drop as an attachment into the new message.

5.Send the email message to [email protected]

 

Please note the system provides no confirmation or notice of receipt for submissions, if an email is just forwarded to the email address then Cisco will not look into the submission as they need the original email in a Multipurpose Internet Mail Extension (MIME)-encoded attachment.

For info there are other email addresses for reporting emails that are spam or phishing, you would change the email address in step 5 to [email protected] for spam and [email protected] for phishing.

Cisco class phishing email to be emails designed to acquire user name(s), passwords, credit card info, or other personally identifiable information, or the email message contains malware attachments.

[Michael]

In the context of phishing, it's always important to reset the user's password immediately as this'll prevent their account being compromised further. This could well by why it appears to be coming from your real domain, when it's actually being spoofed (which would make sense).

 

As for Powershell, you're right and I've used it for years to manage O365. Definitely useful for bulk tasks.

[andy_b]

One other thing to note is that:

 

"The new mail system is DKIM aware, if an email is received which is signed with a DKIM signature and it fails validation the email is then rejected."

 

This has caused a few bounced emails from charities that we work with due to their lack of correct DKIM setup.