Seeing a lot of Missed Spam When Doing a Search Using the Spam Reporting Tool.

I am doing a general search on one user or our entire domain, and it seems a lot of messages aren't being blocked.

The Spam Reporting Tool will keep a copy of every email that didn't fire on the 'Spam Detection' event. It keeps them for 3 days, and only keeps the messages that are smaller then the Maximum queued message size.

If you see a lot of spam in this search, it does not mean they weren't blocked. The spam reporting will show messages that fired on other events such as RBL, SURBL, IP reputation, and filters. It simply doesn't show messages that didn't fire on the 'spam detection' event (spam 3,4, or 5). It is best to look up messages that you know were not blocked by any event and submit these.

This article was originally published in the GWAVA knowledgebase as article ID 2546.