Share via

3.1.4.1 Creating the Junk Email Rule

  • Article

The Junk Email rule is a server-side extended rule that follows the syntax specified in [MS-OXORULE] section 2.2.4.

The Junk Email rule is represented by a folder associated information (FAI) message. The Junk Email rule is created or modified by adding or modifying an FAI message as specified in [MS-OXORULE] section 3.1.4.2.2.

The FAI Message object MUST have properties set as follows.

The PidTagRuleMessageName property ([MS-OXORULE] section 2.2.4.1.1) MUST be set to "Junk E-mail rule".

The PidTagSubject property ([MS-OXCMSG] section 2.2.1.46) MUST be set to "Junk E-mail rule".

The PidTagRuleMessageProvider property ([MS-OXORULE] section 2.2.4.1.7) MUST be set to "JunkEmailRule".

The PidTagRuleMessageState property ([MS-OXORULE] section 2.2.4.1.4) MUST be set to ST_ENABLED | ST_EXIT_LEVEL | ST_SKIP_IF_SCL_IS_SAFE.

The PidTagRuleMessageSequence property ([MS-OXORULE] section 2.2.4.1.3) MUST be set to 0 (zero).

The PidTagRuleMessageUserFlags property ([MS-OXORULE] section 2.2.4.1.5) MUST be set to 0 (zero).

The PidTagRuleMessageLevel property ([MS-OXORULE] section 2.2.4.1.6) MUST be set to 0 (zero).

The PidTagExtendedRuleMessageActions property ([MS-OXORULE] section 2.2.4.1.9) MUST contain the following two actions in the format specified for the PidTagExtendedRuleMessageActions property:

  • An OP_MOVE action to move the message to the Junk Email folder.

  • An OP_TAG action to set the PidNameExchangeJunkEmailMoveStamp property (section 2.2.1.2) on the message that is moved to the Junk Email folder.

The PidTagReportTime (section 2.2.2.6), PidTagJunkIncludeContacts (section 2.2.2.2), and PidTagJunkThreshold (section 2.2.2.5) properties are set as specified. The PidTagExtendedRuleMessageCondition property ([MS-OXORULE] section 2.2.4.1.10) MUST contain the following restrictions. The formats of the restriction structures are specified in [MS-OXCDATA] section 2.12.1 through [MS-OXCDATA] section 2.12.12. All e-mail addresses MUST be of the SMTP address type.

A RES_AND restriction with two subclauses:

  1. A RES_OR restriction with two subclauses:

    1. A RES_OR restriction with zero or more subclauses, one for each bad sender e-mail address. Each subclause MUST be a RES_CONTENT restriction with the FuzzyLevelLow field set to FL_FULLSTRING and the FuzzyLevelHigh field set to FL_IGNORECASE comparing the value of the PidTagSenderEmailAddress property ([MS-OXOMSG] section 2.2.1.49) with a string that contains the e-mail address of a bad sender.

    2. A RES_AND restriction with two subclauses:

      1. A RES_OR restriction with two subclauses:

        • A RES_AND restriction with two subclauses:

          1. A RES_EXIST restriction for the PidTagContentFilterSpamConfidenceLevel property (section 2.2.1.3).

          2. A RES_PROPERTY restriction for the PidTagContentFilterSpamConfidenceLevel property, with a relative operation of RELOP_GT against a value of -1.

        • A RES_OR restriction with zero or more subclauses, one for each bad sender domain. Each subclause MUST be a RES_CONTENT restriction with the FuzzyLevelLow field set to FL_SUBSTRING and the FuzzyLevelHigh field set to FL_IGNORECASE comparing the value of the PidTagSenderEmailAddress property with a string that contains the domain of a bad sender.

      2. A RES_NOT restriction with a RES_OR restriction that has two subclauses:

        1. A RES_OR restriction with zero or more subclauses, one for each trusted sender domain. Each subclause MUST be a RES_CONTENT restriction with the FuzzyLevelLow field set to FL_SUBSTRING and the FuzzyLevelHigh field set to FL_IGNORECASE comparing the value of the PidTagSenderEmailAddress property with a string that contains the domain of a trusted sender.

        2. A RES_SUB restriction for the PidTagMessageRecipients property ([MS-OXCMSG] section 2.2.1.47), with a RES_OR restriction with zero or more subclauses, one for each trusted recipient domain. Each subclause MUST be a RES_CONTENT restriction with the FuzzyLevelLow field set to FL_SUBSTRING and the FuzzyLevelHigh field set to FL_IGNORECASE comparing the value of the PidTagEmailAddress property ([MS-OXOABK] section 2.2.3.14) with a string that contains the domain of a trusted recipient.

  2. A RES_NOT restriction with a RES_OR restriction that has three subclauses:

    1. A RES_OR restriction with zero or more subclauses, one for each trusted sender e-mail address. Each subclause MUST be a RES_CONTENT restriction with the FuzzyLevelLow field set to FL_FULLSTRING and the FuzzyLevelHigh field set to FL_IGNORECASE comparing the value of the PidTagSenderEmailAddress property with a string that contains the e-mail address of a trusted sender.

    2. A RES_SUB restriction for the PidTagMessageRecipients property, with a RES_OR restriction with zero or more subclauses, one for each trusted recipient e-mail address. Each subclause MUST be a RES_CONTENT restriction with the FuzzyLevelLow field set to FL_FULLSTRING and the FuzzyLevelHigh field set to FL_IGNORECASE comparing the value of the PidTagEmailAddress property with a string that the e-mail address of a trusted recipient.

    3. A RES_OR restriction with zero or more subclauses. Each subclause MUST be a RES_CONTENT restriction with the FuzzyLevelLow field set to FL_SUBSTRING and the FuzzyLevelHigh field set to FL_IGNORECASE comparing the value of the PidTagSenderEmailAddress property with a string that contains the e-mail address of a contact from the mailbox's contact list. If the PidTagJunkIncludeContacts property (section 2.2.2.2) is set to 0 (zero), this restriction MUST be empty (NULL); if the PidTagJunkIncludeContacts property is set to 1, then there SHOULD be one of these restrictions for each trusted contact e-mail address.