Export (0) Print
Expand All

Submitting spam and non-spam messages to Microsoft for analysis

Exchange 2013
 

Applies to: Exchange Online Protection, Exchange Online

Topic Last Modified: 2014-04-23

It can be frustrating when users in your organization receive spam messages in their inbox or if they don’t receive a legitimate email message because it’s marked as spam. We’re constantly fine-tuning our spam filters to be more accurate, and you or your end users can help this process by submitting false negative and false positive spam messages to Microsoft for analysis. A false negative is a spam message that should have been but was not identified as spam. A false positive is a legitimate email message that was incorrectly identified as spam.

If you receive a message that passed through the spam filters that you feel should be classified as spam, you can submit this false negative message to the Microsoft Spam Analysis Team, who will review the message and add it to the service-wide spam filters if it meets the spam classification criteria.

You can submit spam messages in the following ways:

  • For Microsoft Office Outlook® users, the primary way to submit spam (junk) is by using a plug-in known as the Microsoft Junk Email Reporting Add-in for Microsoft Office Outlook. For information about installing and using this tool, see Junk Email Reporting Add-in for Microsoft Office Outlook.

  • For Microsoft Outlook Web App (OWA) users, the primary way to submit spam is by using its built-in junk email reporting option. For more information, see Junk Email Reporting in OWA.

  • You can also use email to submit messages to Microsoft that should be classified as spam. When doing so, be sure to use the steps in the following procedure.

  1. Save the message you want to submit as spam to Microsoft.

  2. Create a new, blank message and attach the spam message to it.

  3. Copy and paste the original spam message subject line into the new message subject line.

    ImportantImportant:
    Leave the body of the new message empty.
  4. Send your new message to junk@office365.microsoft.com.

If a message was incorrectly identified as spam, you can submit this false positive message to the Microsoft Spam Analysis Team, who will evaluate and analyze the message. Depending on the results of the analysis, the service-wide spam content filter rules may be adjusted to allow the message through.

You can submit non-spam messages in the following ways:

  • If you use the Move message to Junk Email folder action when configuring your content filters (this is the default action), end users can release false positive messages in their Outlook or OWA Junk Email folder.

    • Outlook users can release false positive messages using the Not Junk right-click menu option. However, they must submit the message to Microsoft via email, as shown in the procedure below.

    • OWA users can release false positive messages and submit them to Microsoft for analysis using the Mark as not junk action. For more information on how to do this, see Junk Email Reporting in OWA.

  • If you use the Quarantine message action instead of the Move message to Junk Email folder action when configuring your content filters:

  • You can also use email to submit messages to Microsoft that should not be classified as spam. When doing so, be sure to use the steps in the following procedure.

  1. Save the message you want to submit as non-spam to Microsoft.

  2. Create a new, blank message and attach the non-spam message to it.

  3. Copy and paste the original message subject line into the new message subject line.

    ImportantImportant:
    Leave the body of the new message empty.
  4. Send your new message to not_junk@office365.microsoft.com.

The spam analysis team examines your submitted messages and adjusts the spam filters accordingly in order to prevent future abuse. As a result, the service is constantly updating and refining the spam prevention and protection processes. Any submitted items are evaluated at the network-wide level. False-positive submissions are examined and assessed for possible rule adjustment to allow future messages through the spam filters. Therefore, notifying the service of false positives and also unfiltered spam is advantageous for you and all customers using the global network. The spam team examines indicators within each submitted message, such as the following:

  • From address

  • Sending IP address

  • Keywords

  • Phrases

  • Frequency of transmission

  • Other trends and patterns

After reviewing this information, the spam team can choose to make the relevant changes to the service’s spam filtering layers. For more information about the spam team, you can watch the English-language only Microsoft Exchange Spam team video.

Spam evaluation is an ongoing process that is applicable regardless of the originating language or character set. Quite often, because a spam message can be vague or even lack text in the subject or message body, the spam team relies on other available message characteristics to perform filtering. This means that after the spam team flags a given message as spam and makes the necessary changes to its rule base, that message will be blocked in the future until its characteristics have been modified enough to avoid our filters. New spam rules are deployed continuously. Timeframes for rules on individual submissions vary depending on the quantity and quality of submissions. Because new spam rules are set globally for all customers, be aware that not all individual spam submissions will result in a new spam rule.

 
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft