Any suggestions? Export (0) Print
Expand All

Submit spam, non-spam, and phishing scam messages to Microsoft for analysis

Exchange Online
 

Applies to: Exchange Online, Exchange Online Protection

Topic Last Modified: 2016-01-14

It can be frustrating when users in your organization receive junk (spam) or phishing scam messages in their inbox, or if they don’t receive a legitimate email message because it’s marked as junk. We’re constantly fine-tuning our spam filters to be more accurate, and you or your end users can help this process by submitting false negative and false positive spam messages to Microsoft for analysis. A false negative is a spam message that should have been but was not identified as spam. A false positive is a legitimate email message that was incorrectly identified as spam.

If you receive a message that passed through the spam filters that and should be classified as junk or a phishing scam, you can submit this false negative message to the Microsoft Spam and Phishing Analysis Teams, who will review the message and add it to the service-wide filters if it meets the classification criteria.

For more spam settings that apply to the whole organization, see Block email spam with the Office 365 spam filter to prevent false negative issues. It contains tips to help prevent false negatives.

You can submit junk email messages in the following ways:

  • For Outlook users, the primary way to submit junk messages is by using a plug-in known as the Microsoft Junk Email Reporting Add-in for Microsoft Outlook. For information about installing and using this tool, see Junk Email Reporting Add-in for Microsoft Outlook.

  • For Outlook on the web users, the primary way to submit junk email messages is by using its built-in junk email reporting option. For more information, see Report junk email and phishing scams in Outlook on the web.

  • You can also use email to submit messages to Microsoft that should be classified as junk or phishing scams as described in the following procedure.

To submit a junk or phishing scam message to Microsoft:

  1. Create a new, blank email.

  2. Address the email to the Microsoft team that reviews messages as follows:

    • For junk messages, address your email to junk@office365.microsoft.com.

    • For phishing scam messages, address your email to phish@office365.microsoft.com.

  3. Copy and paste the junk or phishing scam message into that email (as an attachment).

    NoteNote:
    You can attach multiple messages to the email if you want to. Make sure all the messages are the same type - either phishing scam messages or junk email messages.
    Leave the body of the new message empty.
  4. Click Send.

If a message was incorrectly identified as junk, you can submit this false positive message to the Microsoft Spam Analysis Team, who will evaluate and analyze the message. Depending on the results of the analysis, the service-wide spam content filter rules may be adjusted to allow the message through.

Admins can review more spam setting information that applies to a whole organization. Take a look at How to help ensure that a message isn't marked as spam. This information is helpful if you have administrator-level control and you want to prevent false positives.

You can submit non-spam messages in the following ways:

  • If you use the Move message to Junk Email folder action when configuring your content filters (this is the default action), end users can release false positive messages in their Outlook or OWA Junk Email folder.

    • Outlook users can release false positive messages using the Not Junk right-click menu option. However, they must submit the message to Microsoft via email, as shown in the procedure below.

    • OWA users can release false positive messages and submit them to Microsoft for analysis using the Mark as not junk action. For more information on how to do this, see Report junk email and phishing scams in Outlook on the web.

  • If you use the Quarantine message action instead of the Move message to Junk Email folder action when configuring your content filters:

  • You can also use email to submit messages to Microsoft that should not be classified as spam. When doing so, be sure to use the steps in the following procedure.

Use the same procedure as described above in Use email to submit junk (spam) or phishing scam messages to Microsoft , but send the email to not_junk@office365.microsoft.com.

The spam analysis team examines messages you submit and adjusts the spam filters to prevent future junk mail. As a result, Office 365 spam filters are constantly refined. Any submitted items are evaluated at the network-wide level. False-positive submissions are examined and assessed for possible rule adjustment to allow future messages through the spam filters. Therefore, notifying the service of false positives and also false negatives (unfiltered spam) is advantageous for you and all customers using the global network. The spam team examines indicators within each submitted message, such as:

  • From address

  • Sending IP address

  • Keywords

  • Phrases

  • Frequency of transmission

  • Other trends and patterns

After reviewing this information, the spam team might make changes to the service’s spam filtering layers. For more information about the spam team, you can watch the English-language only Microsoft Exchange Spam team video.

Spam evaluation is an ongoing process that applies regardless of the originating language or character set. Because a spam message can be vague or even lack text in the subject or message body, the spam team relies on other message characteristics to perform filtering. This means that after the spam team flags a given message as spam and makes the necessary changes to its rule base, that message will be blocked in the future until its characteristics have been modified enough to avoid our filters. New spam rules are deployed continuously. Time frames for rules on individual submissions vary depending on the quantity and quality of submissions. Because new spam rules are set globally for all customers, not all individual spam submissions will result in a new spam rule.

 
Show:
© 2016 Microsoft