Export (0) Print
Expand All

Understanding Spam Submission and Evaluation in FOPE

 

Applies to: Forefront Online Protection for Exchange

Topic Last Modified: 2013-03-11

Your users and administrators can help to reduce email abuse by following the procedures provided in this topic. These procedures explain how to submit messages to the Forefront Online Protection for Exchange (FOPE) spam analysis team.

Within the FOPE product, the term spam refers to a message that is unsolicited and unwanted. Any spam filter cannot be perfect however, and occasionally FOPE will allow a message to be delivered to an inbox that might be considered spam. This is why we provide a way for users to notify Microsoft that a message was incorrectly classified. The following procedure explains how to report these types of messages.

TipTip:
For Microsoft Office Outlook® users, the primary way to report spam is by using a plug-in known as the Microsoft Junk Email Reporting Add-in for Microsoft Office Outlook. For more information, see the Junk E-mail Reporting Tool on the Microsoft download center (http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18275).
How to report spam
  1. Create a new, blank message and add the spam message as an attachment.

  2. Copy and paste the original spam message subject line into the new message subject line.

    ImportantImportant:
    Leave the body of the new message empty.
  3. Send your new message to abuse@messaging.microsoft.com.

Within the FOPE product, the term false positive refers to a message that is being blocked or filtered by the FOPE service, but a recipient thinks it should not be. Put another way, a false positive is a message that the recipient wants to allow without it being marked as spam. These messages can be either bulk messages such as newsletters, person-to-person legitimate business communication, or personal email. Through extensive monitoring, FOPE has found that the ratio of false-positive messages is smaller than approximately 1 in 250,000, which is 0.0004 percent. No spam filter can be perfect however. Occasionally, the FOPE service finds items that are believed to be spam but the end-user or message recipient does not want classified as spam. This is why we provide a way for users to notify Microsoft that a message is incorrectly classified. The following procedure explains how to report false positive messages to Microsoft.

TipTip:
The primary way to report false positives is found in your spam quarantine mailbox. In that mailbox, add a check mark to indicate which messages to report, and then click the Not Junk button above the list of messages. For more information, see Manage Quarantined Messages in FOPE.
How to report false positives
  1. Create a new, blank message and add the message you wish to save (that is, the false-positive) as an attachment.

  2. Copy and paste the original message subject line into the new message subject line.

    ImportantImportant:
    Leave the body of the new message empty.
  3. Send your new message to false_positive@messaging.microsoft.com.

For more information about how to help prevent legitimate emails from being marked as SPAM, see: Legitimate email messages are marked as spam for a Forefront Online Protection for Exchange (FOPE) user.

The spam analysis team examines your submitted messages and adjusts the message filters accordingly in order to prevent future abuse. As a result, the FOPE service is constantly updating and refining the spam prevention and protection processes. Any submitted items are evaluated at the network-wide level. False-positive submissions are examined and assessed for possible rule adjustment to allow future messages through the spam filters. Therefore, notifying the service of false positives and also unfiltered spam is advantageous for you and all customers utilizing the FOPE global network. The spam team examines indicators within each submitted message, such as the following:

  • From address

  • Sending IP address

  • Keywords

  • Phrases

  • Frequency of transmission

  • Other trends and patterns

After reviewing this information, the spam team can choose to make the relevant changes to the FOPE spam filtering layers. For more information about the spam team, you can watch the English-language only Microsoft Exchange Spam team video at http://youtu.be/-TpX_-GMC7o?hd=1.

Spam evaluation is an ongoing process that is applicable regardless of the originating language or character set. Quite often, because a spam message can be vague, or even lack text in the subject or message body, the spam team relies on other available message characteristics to perform filtering. This means that after the spam team flags a given message as spam and makes the necessary changes to its rule base, that message will be blocked in the future until its characteristics have been modified enough to avoid our filters. New spam rules are deployed continuously. Timeframes for rules on individual submissions vary depending on the quantity and quality of submissions. Because new spam rules are set globally for all FOPE customers, be aware that not all individual spam submissions will result in a new spam rule.

 
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft