False Positives on Spam Detection

  • 7020847
  • 04-Sep-2015
  • 05-Feb-2021

Environment

Secure Messaging Gateway
GWAVA 6+

Situation

I am seeing a lot of good messages get blocked for Spam 4 or 5 (false positives). What can I do?

Resolution

When a message fires on the spam detection event (Confirmed spam (spam5) or bulk spam (spam 4)) it is because of the content of the email. A lot of time a certain link in a signature can cause Spam 5 to fire. You can do either or both of the following:
  
GWAVA 6+
1) Add a source address exception for the sender's domain or full email address.
a) Go to Scanner / Policy Management | <scanner name> | Exceptions | Source Address (from:)

b) In the blank field, type in the full email address for the sender you want to add. If you want to exclude their entire domain to prevents. Note: If wanting enitre domain, use wildcard i.e. *@domain.com
SMG
1) Add and Email Address filter Exception for the sender's domain or full email address
a) Go to SMG Web UI | System Administration | Organization / Policy Management | Policy scan configuration | Inbound Mail Filter Policy. Find your Spam Filter Group and add an Address exception (if not already added) to the group.
b) Click on the @ icon on the Email Address exception, make sure Scan sender address is checked, then add the senders full address or domain. Note: If wanting enitre domain, use wildcard i.e. *@domain.com

Additional Information

This article was originally published in the GWAVA knowledgebase as article ID 2610.