False Positives on Spam Detection

  • 7020847
  • 04-Sep-2015
  • 05-Feb-2021


Secure Messaging Gateway


I am seeing a lot of good messages get blocked for Spam 4 or 5 (false positives). What can I do?


When a message fires on the spam detection event (Confirmed spam (spam5) or bulk spam (spam 4)) it is because of the content of the email. A lot of time a certain link in a signature can cause Spam 5 to fire. You can do either or both of the following:
1) Add a source address exception for the sender's domain or full email address.
a) Go to Scanner / Policy Management | <scanner name> | Exceptions | Source Address (from:)

b) In the blank field, type in the full email address for the sender you want to add. If you want to exclude their entire domain to prevents. Note: If wanting enitre domain, use wildcard i.e. *@domain.com
1) Add and Email Address filter Exception for the sender's domain or full email address
a) Go to SMG Web UI | System Administration | Organization / Policy Management | Policy scan configuration | Inbound Mail Filter Policy. Find your Spam Filter Group and add an Address exception (if not already added) to the group.
b) Click on the @ icon on the Email Address exception, make sure Scan sender address is checked, then add the senders full address or domain. Note: If wanting enitre domain, use wildcard i.e. *@domain.com

Additional Information

This article was originally published in the GWAVA knowledgebase as article ID 2610.