Submitting Spam Messages to Microsoft for Analysis

A false negative is a spam message that was incorrectly not identified as spam. If you receive a message that passed through the spam filters that you feel should be classified as spam (false negative), you can submit this message to the Microsoft Spam Analysis Team, who will review the message and add it to the spam filters if it meets the spam classification criteria.

Tip:
For Microsoft Office Outlook® users, the primary way to report spam is by using a plug-in known as the Microsoft Junk Email Reporting Add-in for Microsoft Office Outlook. For information about installing and using this tool, see Junk Email Reporting Add-in for Microsoft Office Outlook.

A false positive is a legitimate email message that was incorrectly identified as spam. Administrators and end users can submit false positives to the Microsoft Spam Analysis Team at the following email address: false_positive@messaging.microsoft.com. The spam team evaluates and analyzes the message, and, depending on the results of the analysis, adjusts the anti-spam filter rules to allow the message through.

Use email to submit false positive messages

---

Use the following procedure to submit false positive messages to Microsoft:

1. Create a new, blank message and add the message you wish to save (that is, the false-positive) as an attachment.

2. Copy and paste the original message subject line into the new message subject line.

   Important:
   Leave the body of the new message empty.

3. Send your new message to false_positive@messaging.microsoft.com.

Tip:

Administrators can release spam quarantined messages and report them as false positives from the Exchange admin center. For more information, see Release a Quarantined Message and Optionally Report it as a False Positive. If you use the Move message to Junk Email folder action instead of the Quarantine message action, end users can release false positive messages in their Microsoft Outlook or Microsoft Outlook Web App Junk Email folder using the Not Junk right-click menu option. In this case, the message is not automatically submitted and must be submitted via email, as described in the above procedure.

The spam analysis team examines your submitted messages and adjusts the spam filters accordingly in order to prevent future abuse. As a result, the service is constantly updating and refining the spam prevention and protection processes. Any submitted items are evaluated at the network-wide level. False-positive submissions are examined and assessed for possible rule adjustment to allow future messages through the spam filters. Therefore, notifying the service of false positives and also unfiltered spam is advantageous for you and all customers utilizing the global network. The spam team examines indicators within each submitted message, such as the following:

• From address
  
• Sending IP address
  
• Keywords
  
• Phrases
  
• Frequency of transmission
  
• Other trends and patterns
  

After reviewing this information, the spam team can choose to make the relevant changes to the service’s spam filtering layers. For more information about the spam team, you can watch the English-language only Microsoft Exchange Spam team video at http://youtu.be/-TpX_-GMC7o?hd=1.

Spam evaluation is an ongoing process that is applicable regardless of the originating language or character set. Quite often, because a spam message can be vague or even lack text in the subject or message body, the spam team relies on other available message characteristics to perform filtering. This means that after the spam team flags a given message as spam and makes the necessary changes to its rule base, that message will be blocked in the future until its characteristics have been modified enough to avoid our filters. New spam rules are deployed continuously. Timeframes for rules on individual submissions vary depending on the quantity and quality of submissions. Because new spam rules are set globally for all customers, be aware that not all individual spam submissions will result in a new spam rule.