Spam Confidence Level Protocol

[MS-OXCSPAM]:

Spam Confidence Level Protocol

Intellectual Property Rights Notice for Open Specifications Documentation

Technical Documentation. Microsoft publishes Open Specifications documentation (“this documentation”) for protocols, file formats, data portability, computer languages, and standards support. Additionally, overview documents cover inter-protocol relationships and interactions.

Copyrights. This documentation is covered by Microsoft copyrights. Regardless of any other terms that are contained in the terms of use for the Microsoft website that hosts this documentation, you can make copies of it in order to develop implementations of the technologies that are described in this documentation and can distribute portions of it in your implementations that use these technologies or in your documentation as necessary to properly document the implementation. You can also distribute in your implementation, with or without modification, any schemas, IDLs, or code samples that are included in the documentation. This permission also applies to any documents that are referenced in the Open Specifications documentation.

No Trade Secrets. Microsoft does not claim any trade secret rights in this documentation.

Patents. Microsoft has patents that might cover your implementations of the technologies described in the Open Specifications documentation. Neither this notice nor Microsoft's delivery of this documentation grants any licenses under those patents or any other Microsoft patents. However, a given Open Specifications document might be covered by the Microsoft Open Specifications Promise or the Microsoft Community Promise. If you would prefer a written license, or if the technologies described in this documentation are not covered by the Open Specifications Promise or Community Promise, as applicable, patent licenses are available by contacting .

Trademarks. The names of companies and products contained in this documentation might be covered by trademarks or similar intellectual property rights. This notice does not grant any licenses under those rights. For a list of Microsoft trademarks, visit

Fictitious Names. The example companies, organizations, products, domain names, email addresses, logos, people, places, and events that are depicted in this documentation are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred.

Reservation of Rights. All other rights are reserved, and this notice does not grant any rights other than as specifically described above, whether by implication, estoppel, or otherwise.

Tools. The Open Specifications documentation does not require the use of Microsoft programming tools or programming environments in order for you to develop an implementation. If you have access to Microsoft programming tools and environments, you are free to take advantage of them. Certain Open Specifications documents are intended for use in conjunction with publicly available standards specifications and network programming art and, as such, assume that the reader either is familiar with the aforementioned material or has immediate access to it.

Revision Summary

Date / Revision History / Revision Class / Comments
4/4/2008 / 0.1 / New / Initial Availability.
4/25/2008 / 0.2 / Minor / Revised and updated property names and other technical content.
6/27/2008 / 1.0 / Major / Initial Release.
8/6/2008 / 1.01 / Minor / Updated references to reflect date of initial release.
9/3/2008 / 1.02 / Minor / Revised and edited technical content.
12/3/2008 / 1.03 / Minor / Updated IP notice.
3/4/2009 / 1.04 / Minor / Revised and edited technical content.
4/10/2009 / 2.0 / Major / Updated applicable product releases.
7/15/2009 / 3.0 / Major / Revised and edited for technical content.
11/4/2009 / 3.1.0 / Minor / Updated the technical content.
2/10/2010 / 3.2.0 / Minor / Updated the technical content.
5/5/2010 / 3.3.0 / Minor / Updated the technical content.
8/4/2010 / 3.4 / Minor / Clarified the meaning of the technical content.
11/3/2010 / 3.5 / Minor / Clarified the meaning of the technical content.
3/18/2011 / 3.5 / None / No changes to the meaning, language, and formatting of the technical content.
8/5/2011 / 4.0 / Major / Significantly changed the technical content.
10/7/2011 / 4.0 / None / No changes to the meaning, language, or formatting of the technical content.
1/20/2012 / 5.0 / Major / Significantly changed the technical content.
4/27/2012 / 5.1 / Minor / Clarified the meaning of the technical content.
7/16/2012 / 5.1 / None / No changes to the meaning, language, or formatting of the technical content.
10/8/2012 / 5.2 / Minor / Clarified the meaning of the technical content.
2/11/2013 / 5.2 / None / No changes to the meaning, language, or formatting of the technical content.
7/26/2013 / 5.3 / Minor / Clarified the meaning of the technical content.
11/18/2013 / 5.3 / None / No changes to the meaning, language, or formatting of the technical content.
2/10/2014 / 5.3 / None / No changes to the meaning, language, or formatting of the technical content.
4/30/2014 / 5.3 / None / No changes to the meaning, language, or formatting of the technical content.
7/31/2014 / 5.3 / None / No changes to the meaning, language, or formatting of the technical content.
10/30/2014 / 5.3 / None / No changes to the meaning, language, or formatting of the technical content.
3/16/2015 / 6.0 / Major / Significantly changed the technical content.
5/26/2015 / 6.0 / None / No changes to the meaning, language, or formatting of the technical content.
9/14/2015 / 6.0 / None / No changes to the meaning, language, or formatting of the technical content.
6/13/2016 / 6.0 / None / No changes to the meaning, language, or formatting of the technical content.
9/14/2016 / 6.0 / None / No changes to the meaning, language, or formatting of the technical content.

Table of Contents

1Introduction

1.1Glossary

1.2References

1.2.1Normative References

1.2.2Informative References

1.3Overview

1.4Relationship to Other Protocols

1.5Prerequisites/Preconditions

1.6Applicability Statement

1.7Versioning and Capability Negotiation

1.8Vendor-Extensible Fields

1.9Standards Assignments

2Messages

2.1Transport

2.2Message Syntax

2.2.1Message Object Properties

2.2.1.1PidLidSpamOriginalFolder Property

2.2.1.2PidNameExchangeJunkEmailMoveStamp Property

2.2.1.3PidTagContentFilterSpamConfidenceLevel Property

2.2.2Junk Email Rule Properties

2.2.2.1PidTagJunkAddRecipientsToSafeSendersList Property

2.2.2.2PidTagJunkIncludeContacts Property

2.2.2.3PidTagJunkPermanentlyDelete Property

2.2.2.4PidTagJunkPhishingEnableLinks Property

2.2.2.5PidTagJunkThreshold Property

2.2.2.6PidTagReportTime Property

2.2.3Inbox Folder Properties

2.2.3.1PidTagAdditionalRenEntryIds Property

2.2.4Format of the Junk Email Rule

3Protocol Details

3.1Server Details

3.1.1Abstract Data Model

3.1.1.1Per Mailbox

3.1.1.2Per Messaging Object

3.1.2Timers

3.1.3Initialization

3.1.4Higher-Layer Triggered Events

3.1.4.1Creating the Junk Email Rule

3.1.5Message Processing Events and Sequencing Rules

3.1.5.1Executing the Junk Email Rule on a Message

3.1.6Timer Events

3.1.7Other Local Events

3.2Client Details

3.2.1Abstract Data Model

3.2.1.1Per Mailbox

3.2.1.2Per Messaging Object

3.2.2Timers

3.2.3Initialization

3.2.4Higher-Layer Triggered Events

3.2.4.1Obtaining or Creating the Junk Email Move Stamp

3.2.4.1.1Obtaining the Junk Email Move Stamp

3.2.4.1.2Generating the Junk Email Move Stamp

3.2.4.2Modifying the Junk Email Rule

3.2.4.3Retrieval of Spam Preferences

3.2.4.4User Changes Client Spam Preferences

3.2.4.5Server Junk Email Rule Changes

3.2.4.6User Adds a New Contact to Their Contacts Folder

3.2.4.7User Sends an E-Mail

3.2.5Message Processing Events and Sequencing Rules

3.2.5.1Receiving an E-Mail Message

3.2.6Timer Events

3.2.7Other Local Events

4Protocol Examples

4.1Adding a Sender to the Trusted Recipients List

5Security

5.1Security Considerations for Implementers

5.2Index of Security Parameters

6Appendix A: Product Behavior

7Change Tracking

8Index

1Introduction

The Spam Confidence Level Protocol enables the sharing of preferences for the filtering of unsolicited e-mail messages between the client and the server.

Sections 1.5, 1.8, 1.9, 2, and 3 of this specification are normative. All other sections and examples in this specification are informative.

1.1Glossary

This document uses the following terms:

action: A discrete operation that is executed on an incoming Message object when all conditions in the same rule are TRUE. A rule contains one or more actions.

contact: A person, company, or other entity that is stored in a directory and is associated with one or more unique identifiers and attributes (2), such as an Internet message address or login name.

Contacts folder: A Folder object that contains Contact objects.

domain: A set of users and computers sharing a common namespace and management infrastructure. At least one computer member of the set must act as a domain controller (DC) and host a member list that identifies all members of the domain, as well as optionally hosting the Active Directory service. The domain controller provides authentication (2) of members, creating a unit of trust for its members. Each domain has an identifier that is shared among its members. For more information, see [MS-AUTHSOD] section 1.1.1.5 and [MS-ADTS].

entry ID: See EntryID.

extended rule: A rule that is added to, modified, and deleted from a server by using a mechanism other than standard rules, but is otherwise functionally identical to a standard rule.

folder associated information (FAI): A collection of Message objects that are stored in a Folder object and are typically hidden from view by email applications. An FAI Message object is used to store a variety of settings and auxiliary data, including forms, views, calendar options, favorites, and category lists.

Folder object: A messaging construct that is typically used to organize data into a hierarchy of objects containing Message objects and folder associated information (FAI) Message objects.

Inbox folder: A special folder that is the default location for Message objects received by a user or resource.

Junk Email folder: A special folder that is the default location for Message objects that are determined to be junk email by a Junk Email rule.

Junk Email rule: An extended rule that describes a spam filter.

mailbox: A message store that contains email, calendar items, and other Message objects for a single recipient.

Message object: A set of properties that represents an email message, appointment, contact, or other type of personal-information-management object. In addition to its own properties, a Message object contains recipient properties that represent the addressees to which it is addressed, and an attachments table that represents any files and other Message objects that are attached to it.

message store: A unit of containment for a single hierarchy of Folder objects, such as a mailbox or public folders.

phishing: The luring of sensitive information, such as passwords or other personal information, from a recipient by masquerading as someone who is trustworthy and has a real need for such information.

phishing message: An email message that is designed to trick a recipient into divulging sensitive information, such as passwords or other personal information, to a non-trustworthy source.

recipient: An entity that can receive email messages.

remote operation (ROP): An operation that is invoked against a server. Each ROP represents an action, such as delete, send, or query. A ROP is contained in a ROP buffer for transmission over the wire.

restriction: A filter used to map some domain into a subset of itself, by passing only those items from the domain that match the filter. Restrictions can be used to filter existing Table objects or to define new ones, such as search folder (2) or rule criteria.

ROP request: See ROP request buffer.

rule: An item that defines a condition and an action. The condition is evaluated for each Message object as it is delivered, and the action is executed if the new Message object matches the condition.

Simple Mail Transfer Protocol (SMTP): A member of the TCP/IP suite of protocols that is used to transport Internet messages, as described in [RFC5321].

spam: An unsolicited email message.

spam filter: A filter that checks certain conditions in a message to determine a spam confidence level.

MAY, SHOULD, MUST, SHOULD NOT, MUST NOT: These terms (in all caps) are used as defined in [RFC2119]. All statements of optional behavior use either MAY, SHOULD, or SHOULD NOT.

1.2References

Links to a document in the Microsoft Open Specifications library point to the correct section in the most recently published version of the referenced document. However, because individual documents in the library are not updated at the same time, the section numbers in the documents may not match. You can confirm the correct section numbering by checking the Errata.

1.2.1Normative References

We conduct frequent surveys of the normative references to assure their continued availability. If you have any issue with finding a normative reference, please contact . We will assist you in finding the relevant information.

[MS-OXCDATA] Microsoft Corporation, "Data Structures".

[MS-OXCMSG] Microsoft Corporation, "Message and Attachment Object Protocol".

[MS-OXOABK] Microsoft Corporation, "Address Book Object Protocol".

[MS-OXOMSG] Microsoft Corporation, "Email Object Protocol".

[MS-OXORULE] Microsoft Corporation, "Email Rules Protocol".

[MS-OXOSFLD] Microsoft Corporation, "Special Folders Protocol".

[MS-OXPHISH] Microsoft Corporation, "Phishing Warning Protocol".

[MS-OXPROPS] Microsoft Corporation, "Exchange Server Protocols Master Property List".

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997,

1.2.2Informative References

[MS-OXCFOLD] Microsoft Corporation, "Folder Object Protocol".

[MS-OXCPRPT] Microsoft Corporation, "Property and Stream Object Protocol".

[MS-OXCROPS] Microsoft Corporation, "Remote Operations (ROP) List and Encoding Protocol".

[MS-OXORSS] Microsoft Corporation, "RSS Object Protocol".

1.3Overview

The Spam Confidence Level Protocol enables the client to process e-mail messages that are likely to be phishing messages or spam by doing the following:

Blocking the delivery of messages to the Inbox folder that are from specific senders or classes of senders.

Allowing the delivery of messages that are either from specific senders or to specific recipients, regardless of whether the messages are identified as spam or phishing messages.

The Junk Email rule, which is an extended rule, specifies the client's spam and phishing preferences. When an e-mail message is delivered to a server, the server applies the Junk Email rule against the properties of the e-mail message to determine whether to put the message in the Junk Email folder.

Clients can use the junk email move stamp to indicate that a message bypasses the client's spam filter. A common scenario in which this occurs is when the client's spam filter has already moved the message to the Junk Email folder once. If the user has retrieved a message from the Junk Email folder, it will not be reprocessed. Clients can also set this property to populate a message store with trusted Message objects that are never spam but might look like spam to a spam filter. The RSS Object Protocol, as described in [MS-OXORSS], is a practical example of this method.

1.4Relationship to Other Protocols

The Spam Confidence Level Protocol relies on the following protocols:

The Email Rules Protocol, as described in [MS-OXORULE], to create rules.

The Message and Attachment Object Protocol, as described in [MS-OXCMSG], to create and access Message objects.

The Folder Object Protocol, as described in [MS-OXCFOLD], to access Folder objects.

The Property and Stream Object Protocol, as described in [MS-OXCPRPT], to get and set properties on Message objects and Folder objects.

For conceptual background information and overviews of the relationships and interactions between this and other protocols, see [MS-OXPROTO].

1.5Prerequisites/Preconditions

This protocol assumes that a system is in place to set and retrieve the properties of Message objects and of Folder objects.

1.6Applicability Statement

This protocol defines the properties and rules that are relevant to the processing of spam and phishing messages. This protocol does not specify the algorithm that determines the likelihood of a message being spam or a phishing message or whether to consider a sender safe or blocked.

1.7Versioning and Capability Negotiation

None.

1.8Vendor-Extensible Fields

None.

1.9Standards Assignments

None.

2Messages

2.1Transport

The Spam Confidence Level Protocol uses the same underlying transport as that used by the Message and Attachment Object Protocol, as specified in [MS-OXCMSG], and the Email Rules Protocol, as specified in [MS-OXORULE].

2.2Message Syntax

2.2.1Message Object Properties

The properties persisted on a Message object are listed in sections 2.2.1.1 through 2.2.1.3.

2.2.1.1PidLidSpamOriginalFolder Property

Type: PtypBinary ([MS-OXCDATA] section 2.11.1)

The PidLidSpamOriginalFolder property ([MS-OXPROPS] section 2.302) specifies the folder that contained the message before the message was moved into the Junk Email folder. The value of this property is the entry ID of the folder.