SpamProfiler Blocking and False Positives

This article applies to:

• Trustwave MailMarshal/SEG
• SpamProfiler functionality 

Question:

• How does SpamProfiler classify a message as spam?
• How can I set up SpamProfiler to avoid blocking good email?
• How can I deal with good email that is blocked by SpamProfiler?

Information:

SpamProfiler is a spam filtering system that checks messages as they are being delivered to SEG. SpamProfiler checks messages after all parts have been received, including the headers and body.

SpamProfiler uses a database of signatures of reported spam. The database is based on a combination of factors including user reports and source reputation. This information is gathered from a worldwide network of sources. 

• Signatures are kept current through frequent database updates.

Best Practices

To maximize efficiency and minimize false positives with SpamProfiler, consider the following best practices:

1. Ensure that SpamProfiler can access the remote database. Each email processing server must have real time web access. You can configure proxy settings if required.
   • For more information about how to confirm SpamProfiler connectivity, see article Q12992.
2. In current supported versions, you can use SpamProfiler results in standard rules, and you can apply other rule conditions to refine the rule triggering.
   • SpamProfiler supports checking of both inbound and outbound messages.
3. Apply global Allow lists and user Safe Sender lists to SpamProfiler action.

Dealing with false positives

If you experience unacceptable levels of false positives, review the best practices above. You can also take the following actions:

• You can configure SpamProfiler to quarantine messages to a folder that end users can manage through the MailMarshal Spam Quarantine Management website. (If you set SpamProfiler to deny messages at the Receiver, they are not available for review.)
• You can collect examples of false positives and send them to Trustwave for review:
  1. Ensure that SpamProfiler is set to quarantine messages in a folder.
  2. Using the MailMarshal Console, locate the false positive messages.
  3. Forward the messages to Trustwave. 
     • You can forward messages using the "report as not spam" button on the Console.
     • You can also forward the message to notspam@marshal.com.
  4. When you submit a false positive message to Trustwave as described here, it is automatically validated through a series of checks. If the message passes these checks, it is entered as a correction in the SpamProfiler signature database.
     • Note: If your false positive submission cannot be automatically processed, it will take significantly longer for any change to occur.
  5. The exact timeframe for database updates varies, but normally changes will take effect within hours.
• If the above process does not resolve your issue, or you are experiencing a problem with significant numbers of messages, contact Trustwave Technical Support for assistance.

Notes:

• To configure SpamProfiler, see the Internet Access and SpamProfiler items in MailMarshal Properties. Exact terms and options depend on the version of MailMarshal. Additional information is available in the User Guide and Help.
• For another configuration setting that can help to minimize false positives in some earlier versions, see Trustwave Knowledgebase article Q12699.