Transport Rule Predicates

Article
01/23/2017

Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.

Applies to: Exchange Server 2007, Exchange Server 2007 SP1, Exchange Server 2007 SP2, Exchange Server 2007 SP3

This topic describes the predicates, predicate properties, and values that are available for a computer that has the Microsoft Exchange Server 2007 Hub Transport server role or the Edge Transport server role installed. The Addresses predicate property is also described in detail because of its complexity.

In Exchange 2007, the Transport Rules agents use predicates to populate the conditions and exceptions that are used with a transport rule. Both the Hub Transport server role and the Edge Transport server role can apply transport rules to e-mail messages that pass through the server roles. However, the predicates that are available for each server role are different.

Predicates and Predicate Properties

Predicates instruct a condition or an exception to examine a specific piece of an e-mail message to determine whether the transport rule should be applied to that message. Some predicates examine the To or From fields of a message, whereas others examine the subject, body, or attachment size. To determine whether a transport rule should be applied to a message, most predicates require that you specify a value that the predicates will use to test against the message. These values are assigned to one or more predicate properties. Some predicates do not require predicate properties.

To assign a value to a predicate, you must determine the predicate property of the predicate. For example, you must use the Words predicate property together with the SubjectContains condition. See Table 2 for the predicate properties that you must use for Hub Transport servers. See Table 3 for the predicate properties that you must use for Edge Transport servers.

Some predicates require that you set two predicate properties, because some predicates examine specific fields within sections of an e-mail message, such as the message header fields. When you specify a predicate to examine a message header, one predicate property specifies the specific header field to examine, whereas the second predicate property specifies the value of the message header to test for. In these cases, you must also specify a value for the second predicate property from the Second Predicate Property column of Table 2 and Table 3, depending on the server role. For example, you can configure a predicate to examine the Message-ID header field for a specific string, such as contoso.com.

Table 1 lists the predicate properties that you can use with transport rules that are configured on a Hub Transport server or an Edge Transport server.

Table 1 Predicate properties for transport rules on a Hub Transport server or an Edge Transport server

Predicate property	Expected format	Description
`Addresses` and `Addresses2`	Array of Active Directory mailbox, contact, or distribution group objects	`Addresses` and `Addresses2` accept a single mailbox, contact, mail-enabled user, or distribution group object. See "Assigning Addresses to Conditions and Exceptions" later in this topic for a detailed description of these predicate properties.
`Classification`	Message classification object	`Classification` accepts a message classification object. To specify a message classification object, you must use the Get-MessageClassification command. For example, use the following command to look for the `ExCompanyInternal` message classification: `$Condition.Classification = (Get-MessageClassification ExCompanyInternal).Identity`
`Importance`	Single value of `High`, `Normal`, or `Bulk`	`Importance` accepts the message priority of an e-mail message. Enclose the value in double quotation marks.
`Patterns`	Array of regular expressions	The `Patterns` predicate property accepts a regular expression that can be used to match dynamic text in an e-mail message that follows an identifiable pattern. Enclose the expression in double quotation marks.
`MessageHeader`	Single string	`MessageHeader` accepts a string that can be used to specify an e-mail message header to examine. This predicate property is used together with the `Words` or `Patterns` predicate properties, which specify the value of the header field to match. Enclose the string in double quotation marks.
`SclValue`	Single integer	`SclValue` accepts an integer that can be used to match the spam confidence level (SCL) that is configured on an e-mail message. Enclose the integer in double quotation marks.
`Scope`	Single value of `InOrganization` or `NotInOrganization`	`Scope` accepts a value that is used to determine whether the e-mail message was sent from inside the Exchange 2007 organization or from outside the organization. `Scope` also determines whether the message was sent to a recipient that is inside or outside the organization. Enclose the value in double quotation marks. A sender or recipient is considered inside the organization if either of the following conditions is true: The sender or recipient is a mail-enabled user, distribution group, or public folder that exists within the organization's Active Directory. The domain of the sender or recipient is in the accepted domains list, but it is not an `ExternalRelay` domain. Also, the message must be sent or received by using an authenticated connection. To determine whether mail-enabled contacts are considered inside or outside the organization, the domain part of the address of the recipient or sender is compared with the accepted domains list as described earlier in this section. For more information about accepted domains, see Managing Accepted Domains.
`Size`	Single integer with quantifier, such as `KB` or `MB`	`Size` accepts an integer that specifies the size of an e-mail attachment. When you enter an integer, qualify the value with one of the following units: `B` (bytes) `KB` (kilobytes) `MB` (megabytes) `GB` (gigabytes) `TB` (terabytes) Unqualified integers are treated as bytes.
`Words`	Array of strings	The `Words` predicate property accepts a string that is enclosed in double quotation marks.

Supported Predicates on a Hub Transport Server

Table 2 lists the predicates that can be used with transport rules that are configured on a Hub Transport server.

Table 2 Supported predicates for transport rules on a Hub Transport server

Supported rule predicate	Predicate name	First predicate property	Second predicate property	Description
from people	`From`	`Addresses`	Not applicable	`From` matches mailboxes, mail-enabled users, or contacts that have sent an e-mail message.
from a member of distribution list	`FromMemberOf`	`Addresses`	Not applicable	`FromMemberOf` matches senders of an e-mail message that are members of the specified distribution group.
from users inside or outside the organization	`FromScope`	`Scope`	Not applicable	`FromScope` matches e-mail messages that are sent from the specified scope.
sent to people	`SentTo`	`Addresses`	Not applicable	`SentTo` matches e-mail messages that contain mailboxes, mail-enabled users, or contacts that are the recipients of the message. The specified mailboxes, mail-enabled users, and contacts can exist anywhere in the To, carbon copy (Cc), or blind carbon copy (Bcc) fields of the message.
sent to a member of distribution list	`SentToMemberOf`	`Addresses`	Not applicable	`SentToMemberOf` matches e-mail messages that contain recipients that are members of the specified distribution group. The recipients can exist anywhere in the To, Cc, or Bcc fields of the e-mail message.
sent to users inside or outside the organization	`SentToScope`	`Scope`	Not applicable	`SentToScope` matches e-mail messages that are sent to the specified scope.
between members of distribution list and distribution list	`BetweenMemberOf`	`Addresses`	`Addresses2`	`BetweenMemberOf` matches e-mail messages that are sent between members of two distribution groups.
when any of the recipients in the To field is people	`AnyOfToHeader`	`Addresses`	Not applicable	`AnyOfToHeader` matches e-mail messages that are sent to mailboxes, mail-enabled users, or contacts that are listed in the To field of an e-mail message.
when any of the recipients in the To field is a member of distribution list	`AnyOfToHeaderMemberOf`	`Addresses`	Not applicable	`AnyOfToHeaderMemberOf` matches e-mail messages that are sent to recipients where the recipients are listed in the To field of an e-mail message and are members of the specified distribution group.
when any of the recipients in the Cc field is people	`AnyOfCcHeader`	`Addresses`	Not applicable	`AnyOfCcHeader` matches e-mail messages that are sent to mailboxes, mail-enabled users, or contacts that are listed in the Cc field of an e-mail message.
when any of the recipients in the Cc field is a member of distribution list	`AnyOfCcHeaderMemberOf`	`Addresses`	Not applicable	`AnyOfCcHeaderMemberOf` matches e-mail messages that are sent to recipients where the recipients are listed in the Cc field of an e-mail message and are members of the specified distribution group.
when any of the recipients in the To or Cc fields are people	`AnyOfToCcHeader`	`Addresses`	Not applicable	`AnyOfToCcHeader` matches e-mail messages that are sent to mailboxes, mail-enabled users, or contacts that are listed in the To or Cc fields of an e-mail message.
when any of the recipients in the To or Cc fields is a member of distribution list	AnyOfToCcHeaderMemberOf	`Addresses`	Not applicable	`AnyOfToCcHeaderMemberOf` matches e-mail messages that are sent to recipients where the recipients are listed in the To or Cc fields of an e-mail message and are members of the specified distribution group.
when the Subject field contains specific words	`SubjectContains`	`Words`	Not applicable	`SubjectContains` matches e-mail messages that contain the specified words in the subject field of the message.
when the Subject field or the body of the message contains specific words	`SubjectOrBodyContains`	`Words`	Not applicable	`SubjectOrBodyContains` matches e-mail messages that contain the specified words in the subject field or body of the message.
when a message header contains specific words	`HeaderContains`	`MessageHeader`	`Words`	`HeaderContains` matches e-mail messages where the specified message header field contains the specified message header field value.
when the From address contains specific words	`FromAddressContains`	`Words`	Not applicable	`FromAddressContains` matches e-mail messages that contain the specified words in the From field of the message.
when the Subject field contains text patterns	`SubjectMatches`	`Patterns`	Not applicable	`SubjectMatches` matches e-mail messages where text patterns in the Subject field of the message match a specified regular expression.
when the Subject field or the body of the message contains text patterns	`SubjectOrBodyMatches`	`Patterns`	Not applicable	`SubjectOrBodyMatches` matches e-mail messages where text patterns in the Subject field or body of the message match a specified regular expression.
when the message header contains text patterns	`HeaderMatches`	`MessageHeader`	`Patterns`	`HeaderMatches` matches e-mail messages where the specified message header field contains text patterns that match a specified regular expression.
when the From address contains text patterns	`FromAddressMatches`	`Patterns`	Not applicable	`FromAddressMatches` matches e-mail messages that contain text patterns in the From field of the message that match a specified regular expression.
when any attachment file name contains text patterns	`AttachmentNameMatches`	`Patterns`	Not applicable	`AttachmentNameMatches` matches e-mail messages that contain text patterns in attachment file names that match a specified regular expression.
with a spam confidence level (SCL) rating that is greater or equal to limit	`SclOver`	`SclValue`	Not applicable	`SclOver` matches e-mail messages that are configured by using the specified spam confidence level (SCL).
when the size of any attachment is greater than or equal to limit	`AttachmentSizeOver`	`Size`	Not applicable	`AttachmentSizeOver` matches e-mail messages that contain attachments that are larger than the specified value.
marked with classification	`HasClassification`	`Classification`	Not applicable	`HasClassification` matches e-mail messages that are classified with the specified classification.
marked with importance	`WithImportance`	`Importance`	Not applicable	`WithImportance` matches e-mail messages that are set to the specified importance.

Supported Predicates on an Edge Transport Server

Table 3 lists the predicates that can be used with transport rules that are configured on an Edge Transport server.

Table 3 Supported predicates for transport rules on an Edge Transport server

Supported rule predicate	Predicate name	First predicate property	Second predicate property	Description
when the Subject field contains specific words	`SubjectContains`	`Words`	Not applicable	`SubjectContains` matches e-mail messages that contain the specified words in the Subject field of the message.
when the Subject field or the body of the message contains specific words	`SubjectOrBodyContains`	`Words`	Not applicable	`SubjectOrBodyContains` matches e-mail messages that contain the specified words in the Subject field or body of the message.
when a message header contains specific words	`HeaderContains`	`MessageHeader`	`Words`	`HeaderContains` matches e-mail messages where the specified message header field contains the specified message header field value.
when the From address contains specific words	`FromAddressContains`	`Words`	Not applicable	`FromAddressContains` matches e-mail messages that contain the specified words in the From field of the message.
when any recipient address contains specific words	`AnyOfRecipientAddressContains`	`Words`	Not applicable	`AnyOfRecipientAddressContains` matches e-mail messages that contain the specified words in the To, carbon copy (Cc), or blind carbon copy (Bcc) fields of the message.
when the Subject field contains text patterns	`SubjectMatches`	`Patterns`	Not applicable	`SubjectMatches` matches e-mail messages where text patterns in the Subject field of the message match a specified regular expression.
when the Subject field or the body of the message contains text patterns	`SubjectOrBodyMatches`	`Patterns`	Not applicable	`SubjectOrBodyMatches` matches e-mail messages where text patterns in the Subject field or body of the message match a specified regular expression.
when the message header contains text patterns	`HeaderMatches`	`MessageHeader`	`Patterns`	`HeaderMatches` matches e-mail messages where the specified message header field contains text patterns that match a specified regular expression.
when the From address contains text patterns	`FromAddressMatches`	`Patterns`	Not applicable	`FromAddressMatches` matches e-mail messages that contain text patterns in the From field of the message that match a specified regular expression.
when text patterns in any of recipient address	`AnyOfRecipientAddressMatches`	`Patterns`	Not applicable	`AnyOfRecipientAddressMatches` matches e-mail messages where text patterns in the To, Cc, or Bcc fields of the message match a specified regular expression.
with a spam confidence level (SCL) rating that is greater than or equal to limit	`SclOver`	`SclValue`	Not applicable	`SclOver` matches e-mail messages that are configured by using the specified SCL.
when the size of any attachment is greater than or equal to limit	`AttachmentSizeOver`	`Size`	Not applicable	`AttachmentSizeOver` matches e-mail messages that contain attachments that are larger than the specified value.
from users inside or outside the organization	`FromScope`	`Scope`	Not applicable	`FromScope` matches e-mail messages that are sent from the specified scope.

Assigning Addresses to Conditions and Exceptions

The Addresses predicate property requires that you pass a full mailbox, contact, mail-enabled user, or distribution group object to the property. Simple Mail Transfer Protocol (SMTP) e-mail addresses aren't valid values for this property. Values that are assigned to the Addresses predicate property must be in an array.

To pass a mailbox, contact, mail-enabled user, or distribution group object to the Addresses predicate property, you must call the appropriate Exchange Management Shell command from within the array and supply the command with the identity or name of the object. You must enclose the command name and identity in parentheses. Use the following command syntax:

$Condition.Addresses = @((Get-Mailbox <Mailbox Name>), (Get-MailContact <Contact Name>), (Get-MailUser <Mail-Enabled User>), (Get-DistributionGroup <Distribution Group Name>))

To assign values to the Addresses predicate property

Run the following command to assign a single mailbox object:
```
$Condition.Addresses = @((Get-Mailbox "Ted Bremer"))
```
Run the following command to assign a single mail contact object:
```
$Condition.Addresses = @((Get-MailContact "Masato Kawai"))
```
Run the following command to assign a single mail-enabled user object:
```
$Condition.Addresses = @((Get-MailUser "Pilar Ackerman"))
```

Run the following command to a single distribution group object:

$Condition.Addresses = @((Get-DistributionGroup "Sales Group"))

Run the following command to assign a mix of mailbox, user, and distribution group objects:

$Condition.Addresses = @((Get-Mailbox "Ted Bremer"), (Get-Mailbox "Kim Akers"), (Get-MailContact "Pilar Ackerman"), (Get-MailContact "Adam Barr"), (Get-MailUser "Chris Meyer"), (Get-DistributionGroup "Marketing Group"), (Get-DistributionGroup "Research Group"))

For More Information

For detailed syntax and parameter information about each command, see the following topics:

For more information about transport rules, see the following topics: