Reporting false negatives and false positives
Notes
What are false negatives and false positives?
-
False negatives are unwanted emails that were not detected by NoSpamProxy. In case you have received contaminated emails from one of your partners, we recommend that you block the affected email addresses. See Creating a blocklist. Another option is to use the Word matching filter to assign positive or negative SCL scores to specific words and phrases.
-
False positives are legitimate emails that have been blocked by NoSpamProxy. In the event that trusted emails have been assessed as malicious by one of your partners, we recommend that you explicitly allow the email addresses concerned. See Creating an allowlist.
Both cases can be triggered by different filters and actions.
Dealing with compromised partners
Information on dealing with compromised partners can be found under Recommendations for dealing with compromised partners.
General
-
Do not stockpile emails.
-
Do not send us any ZIP archives.
-
False positives and false negatives should always be reported on a daily basis so that further delivery attempts are filtered correctly.
-
Reports should not be older than 7 days.
Core Antispam Engine
Should you notice any false positives, we recommend that you
- set the trust value to 40 or higher if the partner has at least one valid SPF entry, or
-
If emails have been incorrectly classified as safe (false negatives) or malicious (false positives), you can report them to our cloud-based NoSpamProxy services via the user interface.
Proceed as follows:
- Click Report misclassification below the detail dialog.
The reported misclassifications are used to improve detection by 32Guards and by the Core Antispam Engine. The following data is sent to our NoSpamProxy services:
- Subject
- Sent date
- Sender (envelope and header)
- Captured URLs
- Size
- TLS information
- SHA256 hashes and file names of all attachments
- Core Antispam Reference ID
- Type: False positive/false negative
- Transaction ID
Alternatively, send us the respective email as an attachment to an e-mail to spamreport@nospamproxy.de.
32Guards
If emails have been incorrectly classified as safe (false negatives) or malicious (false positives), you can report them to our cloud-based NoSpamProxy services via the user interface.
Proceed as follows:
- Click Report misclassification below the detail dialog.
The reported misclassifications are used to improve detection by 32Guards and by the Core Antispam Engine. The following data is sent to our NoSpamProxy services:
- Subject
- Sent date
- Sender (envelope and header)
- Captured URLs
- Size
- TLS information
- SHA256 hashes and file names of all attachments
- Core Antispam Reference ID
- Type: False positive/false negative
- Transaction ID
Alternatively, send us the complete message track of the respective email to spamreport@nospamproxy.de.
URL Safeguard
The URL Safeguard is based on 32Guards and ensures that NoSpamProxy searches for harmful URLs in emails and blocks affected emails.
To report misclassified URLs, send us the complete message track of the respective email to spamreport@nospamproxy.de.
Viewing rewritten URLs
- Go to Monitoring > Message tracking.
-
- Switch to the URL Safeguard tab.
All malicious URLs are displayed here. Click Show all URLs to also show the benign URLs.
Realtime blocklists
NoSpamProxy Support has no influence on the rating of the respective services. We encourage you to use the reporting options provided by these services. You can find more information about this on the websites of the respective providers.
Spam URI Realtime Blocklists
NoSpamProxy Support has no influence on the rating of the respective services. We encourage you to use the reporting options provided by these services:
Reputation filter
NoSpamProxy support has no influence on the results of the respective checks, such as SPF failed or Unsecured connection in the reputation filter.
In such cases, we recommend that you inform your communication partner of the problem and/or adjust the corresponding check. We also recommend generally pursuing an allowlisting approach.