A false negative is unwanted mail that passed filtering. Report representative originals and inspect the delivery path so the correction targets the real cause.
IN THIS ARTICLE
01 Report and investigate
- Preserve the original unwanted message, including its full headers.
- Find its SpamExperts log entry using recipient, sender and time.
- Check whether an allow entry, custom action or bypass route influenced the result.
- Use the portal's spam-report or training option for the original message.
- Review later examples from the same campaign and apply a narrow sender block only when appropriate.
02 Submit the original through the training page
At the affected Domain or Email User scope, open Incoming > Train messages. Upload the original .eml with its headers and body intact, select the spam option, choose Continue and confirm Report as spam. The dashboard accepts up to 5 MB per message; use another supported reporting method for a larger original.
03 Confirm filtering was used
If no record exists, determine whether mail reached the mailbox directly through an old MX or another route. The mailbox administrator should review the approved delivery paths. Do not assume that marking mail as spam in a desktop application automatically trains a separate gateway service.
Common questions
Should I forward the message as ordinary text?
Use an original attached message or the portal's reporting control. The original structure and routing information help classification analysis.
Will blocking one address stop a campaign?
It may help with a fixed source, but changing sender identities can make individual entries ineffective. Report representative samples and review common evidence.
What if a legitimate supplier was compromised?
Verify with the supplier through a known contact, and review the requested action. A previously trusted sender can still send harmful content after compromise.
Keep the response proportional to the evidence. Removing an overly broad allow entry may solve the problem more cleanly than adding hundreds of blocks. For credential or payment theft attempts, follow the organisation's incident process as well as the mail-filter feedback workflow.