Andrew, what a great and helpful post. You explained why not to use the x-header which I hadn't realized. I need to modify some 30 rules quickly but it will be a labor of love.
Now my question.. Can Microsoft provide a way (somehow) to tell us which word triggered the transport rule? We (as you know) have a list of bad words... Actually, 30plus lists due to byte count limitations and attachment vs body/subject.
We've long ago added the x-header per you earlier advice, but it isn't enough to know which rule, when I've 60 words in the rule and now need to know which word triggered so we can coach the sender/recipient or adjust the rule.
Your thoughts on whether you or your community think it would be helpful to ALSO know which word?
Thanks and keep writing - David