A false positive is legitimate mail classified as unwanted. Correct the particular message and investigate its cause before weakening filtering for a whole domain.
IN THIS ARTICLE
01 Investigate and correct
- Locate the original message in the incoming logs or quarantine.
- Confirm with the recipient that the message and requested action are expected.
- Review the classification evidence, sender identity, authentication result and attachment type.
- Release the legitimate item if available and submit it as not spam through the supported training control.
- Ask the sender for a new small test and compare the result.
02 Submit the legitimate original for training
At the affected Domain or Email User scope, open Incoming > Train messages. Upload the original .eml, select the legitimate option, choose Continue and confirm Report as legitimate. Keep the original headers and body intact. The dashboard limit is 5 MB per message.
Messages deliberately left unfiltered, such as allow-listed traffic, are excluded from training. Training also cannot repair a sending server's invalid SMTP greeting; that sender must correct its configuration.
03 Find a lasting fix
If the sender has broken authentication or an unexpected forwarding path, ask its administrator to correct that configuration. If an account-specific rule caused the hold, review that rule's scope. Document a temporary exception with an owner and review date when business continuity requires one.
Common questions
Does training immediately guarantee the next message passes?
No. Training provides classification feedback; other controls and message differences can still affect handling. Test and monitor.
What original should I submit?
Use the actual received item with its headers, preferably through the portal's message action. An ordinary inline forward can lose useful evidence.
Why are only messages with one attachment blocked?
The attachment type or content may be the relevant factor. Review the classification instead of broadly allowing every message from that sender.
Give us two or three representative message identifiers, their times and the expected outcome. Explain whether other mail from the same sender succeeds. Avoid sending unrelated customer correspondence as a sample set. Once the issue is resolved, remove temporary bypasses that are no longer required and confirm normal filtering remains active.