Problem

Inbound or Outbound calendar invites sent from Microsoft Outlook are often being classified by the Anti-Spam Engine as Low Confidence spam.

Resolution

I. When the message is composed using Outlook 2010:

Outlook 2010 embeds the calendar information as base64 encoded text/calendar, which is detected by the Policy Engine and the body of the email is effectively interpreted as empty. By default, all messages that are detected as empty-body by Dynamic Anti-Spam (DAS) engine are classified as Low Confidence spam and handled as per the settings for this category.

To avoid any restrictive actions taken because of the Low Confidence spam tag, you can create an Inbound/Outbound policy that will force such calendar invites to bypass the DAS engine (and any other subsequent filter policies) and send the email directly to the delivery policy phase.

Below are the steps to create such policy:

1. Go to Content Policies > Inbound and/or Outbound > Filter Policies > New Filter Policy

2. Under "IF", select "Keyword Match" and then check the "Any of the following: Words or Phrases" radio button. In the field, paste the following:

BEGIN:VCALENDAR
Content-Type: text/calendar

3. Click Next and under "ACTION", select "ACCEPT: skip past all remaining policies in this phase and proceed directly to the next one"

IMPORTANT: The policy must be placed before the Default Global Anti-Spam Policy, otherwise it will not work as expected.

RESULT:
Any Outlook calendar invite or response will bypass the Anti-Spam policy (and any other subsequent filter policies); will not be tagged as spam and will be sent to the delivery phase policies for processing.

II. When the message is composed using Outlook 2013 or later (requires additional policy):

1. Go to Content Policies > Inbound and/or Outbound > Filter Policies > New Filter Policy

2. Under "IF", select "Headers" and then select Message Contains "Specific content in the following headers". Select Standard Header "Content Type" and in the field "Any of the following words or phrases " paste the following:

text/calendar

3. Click Next and under "ACTION", select "ACCEPT: skip past all remaining policies in this phase and proceed directly to the next one"

IMPORTANT: The policy must be placed after the policy in section I (see above) and before the Default Global Anti-Spam Policy, otherwise it will not work as expected.

RESULT:
Any Outlook calendar invite or response will bypass the Anti-Spam policy (*and any other subsequent filter policies*); will not be tagged as spam and will be sent to the delivery phase policies for processing.