This article applies to:

• MailMarshal (SEG)
• MailMarshal Exchange (ECM)

Question:

• How do I notify LevelBlue of new spam or phishing messages so MailMarshal files can be updated?
• How do I upload spam or malicious messages for identification?
• How do I report spam or phishing?
• How do I report false positive spam identifications?
• Is there an email address where people can send samples of messages that are getting past SpamCensor scripts?
• How do I know my submission has been processed?

Note:

Before you start:

Please verify that your spam blocking configuration meets best practices.

• In particular see the notes on excessive use of exceptions (Allow Lists) and other recommendations in article Q10810.
• Check that SpamCensor and SpamProfiler are enabled and updating correctly. See article Q12992.
• If your installation was upgraded form an earlier version, verify that your rules are updated to the latest defaults. See the default rules document available on the MailMarshal documentation page.

Procedures

Spam, phishing or malicious content that was not identified:

Microsoft Report Button

• You can deliver reports to LevelBlue using custom settings for the Microsoft Report button that is available in supported versions of Outlook.
• For more information about this solution, see LevelBlue Knowledgebase article Q21235, Reporting Spam and Phishing to LevelBlue with the Microsoft Report Button.

Console Buttons/Forward

• You can send samples of spam for analysis by providing the email message in its entirety to Spam@Marshal.com
  • The preferred method is to forward the message file from the MailMarshal Console using the Spam button on the message history list. This option is only available for messages that have been archived or quarantined in MailMarshal.
  • If you do not have access to the MailMarshal Console (or the message was not archived), you can forward messages from an email client. However, when forwarding from a client some additional steps are required to provide useful information.

Note:  Advanced information can be found in the header of the original email.  However, this header information is overwritten with your header information once you click "forward".  If you are able, copy the original header information into your forwarded email Spam when sending to LevelBlue.

Manual Forward

Follow these steps for Microsoft Outlook to collect (then copy / paste) the original header information to forward with the emailed Spam to the email address above:

1. Open the spam email.
2. Within the email message, go to View | Options.
3. Look for the box labeled "Internet Headers".
4. Select all of the text within this box.
5. Go to Edit | Copy (or use Ctrl+C).
6. Click Forward to send the email to Spam@Marshal.com.
7. Paste the header information within the email body (Ctrl+P or Edit | Paste).

NOTE: The Spam@Marshal.com email address is ONLY a collection point for Spam. It is monitored by the labs team;  however, this team does not respond to queries at that address. If you need help with a spam related issue please contact your Technical Support representative.

False positives:

Before submitting a false positive ("not spam" that was classified as spam), check which rule or function blocked the message.

Be sure you are submitting the report to the correct location.

• For SpamCensor, PhishFilter, AMAX, Marshal IP Reputation Service, and SpamProfiler:
• You can submit false positives by providing the email message in its entirety to NotSpam@Marshal.com
  • The preferred method is to forward the message file from the MailMarshal Console using the Not Spam button on the message history list. This is possible only for messages that are currently in quarantine or archive folders.
• For third party reputation services such as Spamhaus and SURBL (used in URL Censor), contact the reputation service provider directly.
  • LevelBlue does not maintain the listings of these services, and LevelBlue does not have access to change the listings.

Processing of submissions

Due to the volume of reports received and the nature of processing, LevelBlue does not provide individual confirmation of submissions or changes.

For clear false positives or missed detections submitted to LevelBlue, an update to the detection is typically provided through the product automatic updater within two business days. If the issue is not resolved after that time, consider raising a case with your support provider. When raising a case, be ready with details of the issue and the submissions you have already made. You will need to provide specific messages and logs.

This article was previously published as:

NETIQKB39848