Community
User Guides
Support
Community
Help Forums
English Forum
General
About our Community
General Discussion
News and Feedback
Products
F-Secure SAFE
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Other products
Beta programs
Feature Requests
Finnish Forum (Tukifoorumi)
Tuotteet Kotiin
F-Secure SAFE
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Muut tietoturvatuotteet
Support Articles
Language
English
Suomi
Deutsch
Français
日本語
Svenska
Dansk
Italiano
Nederlands
Norsk
Polski
中文 (繁體)
Products & Services
F-Secure TOTAL
F-Secure SAFE / Internet Security / Anti-Virus
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Other products
Common topics
User Guides
Support
Login
|
Register
Spam message has passed through F-Secure Messaging Security Gateway (MSG) to a recipient - F-Secure Community
<main> <article class="userContent"> <h3 data-version="7" data-article="000003889">Issue:</h3> <p>Recipients receive spam messages, why did F-Secure Messaging Security Gateway (MSG) not block these spam messages?</p> <h3>Resolution:</h3> <p>If recipients receive spam messages, it could be because of the following potential root causes:<br><br><b>1. Low spam score (False Negative)</b><br>Check spam scores from message headers. Look for "X-Proofpoint" headers and check the scores.<br><br><b>Example:</b><br>X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-03-08_12:,,<br> signatures=0<br>X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=39 malwarescore=0<br> phishscore=0 bulkscore=12 spamscore=0 mlxscore=0 mlxlogscore=518<br> adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1<br> engine=8.0.1-1711220000 definitions=main-1803080233<br><br>If you encounter messages that should've been classified as spam you can report them through a support ticket. You can either save the message and send the eml or msg file to the ticket, or if the message has been caught in, for example, an audit quarantine in msg, you can report it from the relevant quarantine folder.<br><br>After reporting the False Positive or False Negative spam from F-Secure Messaging Security Gateway (MSG) management portal, at the very top of the main MSG screen, you'll see a message with the reference ID that you need to provide to the support ticket.<br><br><b>2. Safe listed</b><br>This needs to be investigated closer through the <b>MSG Web UI</b>.<br></p><ol><li>Get the Session ID, or <b>SID</b>, for the message by looking it up in <b>Smart Search</b> (<b>System->Smart Search->Search</b>, expand message details by clicking <b>+</b>-sign left of timestamp)</li><li>Search the filter log using the particular message SID, to find out more about filtering done on the message. (<b>Logs and Reports->Log Viewer</b>, if you don't find any results, make sure the <b>Log File Type</b> is set to <b>Filter.</b></li></ol><b>Note:</b> You might also need to switch between servers using the <b>Server</b>-dropdown menu, or check the box labelled <b>Include Old Log Files</b>)<br><br><br>In the example below, spam score is modified (set to zero) because the sender address is in the organizational or personal safe list of the recipient.<br><br>Filter log:<br><br>[2018-03-06 18:43:55.695094 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=access cmd=run rule=spamsafe duration=0.000<br>[2018-03-06 18:43:55.695113 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=session cmd=judge module=access rule=spamsafe<br>[2018-03-06 18:43:55.695348 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=session cmd=dispose module=access rule=spamsafe action=execute value="svar('SpamScore', 0)"<br><br>To check <b>organizational safe lists</b>, Navigate to <b>Email Protection->Spam Detection->Settings->Organizational Safe List</b> in the <b>MSG Web UI</b>.<br><br>To check the <b>personal safe list</b> of the recipient, Navigate to <b>System->User Management->Users</b>, locate the recipient and click on them to open details. You find the personal safe list under the <b>Filtering</b>-tab in the popup window. <p>Article no: 000003889</p> </article> </main>