So here is the situation, we are trying to filter out spam emails within our organizations Exchange 2010 mail server and for the most part we have been pretty successful. Except for a few emails.
Under transportation rules we have a rule:
Apply rule to messages when the message From address matches
Then we have a list of addresses we get spam from
*@*.agency *@*.club *@*.host *@*.icu
When an email that matches one of these rules gets sent to the organization it gets sent to another email address for moderation and does not get sent to the user.
Now this is the part we haven't been able to figure out. Sometimes this works (>90% of the time). However there are sometimes where the emails that match these addresses still get through and we are not sure why or how to prevent it.
If anyone has any insight into why this can happen it would be a big help.