7020847: False Positives on Spam Detection

This document (7020847) is provided subject to the disclaimer at the end of this document.




: I am seeing a lot of good messages get blocked for Spam 4 or 5 (false positives). What can I do?


When a message fires on the spam detection event (Confirmed spam (spam5) or bulk spam (spam 4)) it is because of the content of the email. A lot of time a certain link in a signature can cause Spam 5 to fire. You can do either or both of the following:

1) Add a source address exception for the sender’s domain or full email address.

a) Go to Scanner / Policy Management | <scanner name> | Exceptions | Source Address (from:)

b) In the blank field, type in the full email address for the sender you want to add. If you want to exclude their entire domain to prevents

Additional Information

This article was originally published in the GWAVA knowledgebase as article ID 2610.


This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented “AS IS” WITHOUT WARRANTY OF ANY KIND.


Leave a Reply