How to notify Microsoft of false negative and false positive spam messages that are identified by Antigen or Forefront

This article describes how to notify Microsoft when the Microsoft Advanced Spam Manager or Forefront Protection 2010 for Exchange Server (FPE) does not identify an unsolicited commercial e-mail message as spam. This is also known as a false negative. Additionally, the article describes how to notify Microsoft when the Advanced Spam Manager or FPE incorrectly identifies a legitimate e-mail message as spam. This is also known as a false positive.

It is most effective to report spam messages as you receive them during the day or night. You must not archive spam messages and then release them one time per day or one time per a week. Most spam messages are time sensitive. If the submissions occur throughout the day, Microsoft can respond to spam messages in a timely manner.

Submitting false positives and false negatives to Mail-Filters

If you notice that the SpamCure engine is reporting false positives or false negatives, you can forward these e-mail messages to Microsoft for analysis by Mail-Filters. When forwarding the message, include the following information:

• The words "Antigen false positive" or "Antigen false negative" at the beginning of the message subject line, depending on the kind of submission.
• Your name, e-mail address, and telephone number in the body of the e-mail message.
• The operating system of the server on which Antigen is installed. For example, you could include "Windows Server 2003" in the body of the e-mail message.

The following e-mail addresses were created to process these messages:

Submitting false positives and false negatives to Cloudmark

To submit a false positive or false negative spam e-mail message to Cloudmark, send the e-mail message as an RFC 2822 attachment (.eml). Do not send misclassified messages by using the Forward command. The Forward command strips the messages of essential header information and results in an invalid submission.

False positives (legitimate e-mail messages marked as spam by Cloudmark) should be sent to the following e-mail address:

Forefront-legit@submit.cloudmark.com

False negatives (spam not detected by Cloudmark) should be sent to the following e-mail address:

Forefront-spam@submit.cloudmark.com

Note To attach an e-mail message as an RFC 2822 attachment, follow these steps:

1. In Microsoft Outlook, create a new e-mail message.
2. Address it to the appropriate address.
3. Click the Attach Item button, select the e-mail messages that were falsely classified, and then click OK.