Select your language

Hosted Exchange: Spam Filter Basics and Responsibilities

Note: This help article applies only to Hosted Exchange. If you are not sure which email service you use, you can find more information in the following article.

https://www.green.ch/en/which-email-service-do-i-use

 

The Hosted Exchange spam filter checks incoming and outgoing emails based on various technical characteristics. These include the reputation of senders, domains and IP addresses, SPF, DKIM and DMARC checks, embedded links and attachments, sending patterns, message content and known threat indicators.

The spam filter provides protection against spam, phishing, malware and other unwanted messages. However, it cannot guarantee that every unwanted email will be detected or that every legitimate email will be delivered. A message is always assessed based on a combination of different checks.

A spam filter evaluates emails based on technical characteristics, not on how well known a company is or the recipient’s personal relationship with the sender. Therefore, emails from well-known companies may also be classified as spam if certain technical checks are triggered.

 

Possible Results of the Spam Check

Depending on the check result, an email may be processed in different ways.

  • The email is rejected during transmission. The sending mail server receives an error message.
  • The email is accepted and moved to the server-side quarantine.
  • The email is delivered but marked as spam or moved to the Junk or Spam folder.

In addition, local or server-side rules may move or delete an email that has already been delivered. Quarantine and the Junk or Spam folder are therefore not the same.

 

How Spam Filters Assess Messages

Spam detection is not based on a single characteristic. Each message undergoes several checks.

Commonly used checking methods include:

  • Checking sender, domain and IP reputation
  • Blocklists and allowlists
  • SPF, DKIM and DMARC checks
  • Analysis of links and attachments
  • Checking technical header information
  • Detection of phishing and fraud patterns
  • Analysis of sending behaviour and sending patterns
  • Content checks and security checks

An overall assessment is generated from the various checks. If a defined threshold is exceeded, the message may be classified as spam, moved to quarantine or rejected.

Links to websites that are listed on global blocklists may also increase the spam score.

 

Why Important Emails May End Up in the Spam Folder

Many reputable companies use newsletter systems, tracking links or bulk mailing platforms. These technical characteristics may trigger assessments by spam filters that are similar to those triggered by unwanted messages.

Typical examples include check markers such as ARGDBL, LINKRISK, BULKMAILER or increased assessment levels such as WEIGHT10, WEIGHT15 or WEIGHT20. These entries indicate which filter rules were triggered for a message.

This does not automatically mean that a message is dangerous or unwanted. The spam filter merely assesses the detected technical characteristics.

 

Responsibilities of Administrators and Users

Administrators are responsible for managing the available spam filter settings.

These responsibilities include in particular:

  • Managing quarantine
  • Managing allowlists
  • Managing blocklists
  • Reviewing spam filter policies
  • Adjusting spam filter policies

Entries in allowlists and blocklists may apply to email addresses, domains or IP addresses and apply across the organisation.

Users and administrators should check the following if emails are missing or have been filtered unexpectedly:

  1. Check the Junk or Spam folder.
  2. Check quarantine.
  3. Check existing rules and forwarding settings.
  4. Check existing allowlist and blocklist entries.
  5. In the event of rejection, check the complete non-delivery report.

 

Spam Filter Learning Capability

Spam filters can learn. When unwanted messages are treated as spam and legitimate messages are explicitly allowed, this information may be incorporated into future assessments.

New spam campaigns, phishing attacks and fraud attempts must first be detected. New threats may therefore initially appear inconspicuous until sufficient information is available for a reliable assessment.

It is therefore advisable to:

  • add important senders to the allowlist
  • continue to treat unwanted messages as spam
  • mark legitimate messages as allowed
  • not reply to spam or phishing messages

 

Responsibility of the Email Platform and External Email Providers

The email platform handles technical processing as well as spam and threat protection.

For outgoing emails, however, the receiving email system always decides whether to accept, quarantine, delay or reject a message.

Each email provider uses its own spam filters, reputation systems and blocklists. An allowlist in Hosted Exchange therefore cannot guarantee that a message will be delivered by an external email provider.

You can find more information about delivery problems at:

https://www.green.ch/en/gmail-delivery-problems

https://www.green.ch/en/hotmail-/-outlookcom-delivery-problems

https://www.green.ch/en/bluewin-delivery-problems

 

Adjust Spam Filter Settings

A general relaxation or deactivation of spam filter policies is not suitable for every organisation.

Less strict filters may result in more unwanted or harmful messages being delivered.

Therefore, first check quarantine, the allowlist, the blocklist and the specific characteristics of the affected message.

More information:

https://www.green.ch/en/how-do-i-manage-my-spam-filter-in-edgepilot

https://www.green.ch/en/hosted-exchange-spam-filter-policies

https://www.green.ch/en/hex-spam-filter-set-too-strictly

 

Emails in Quarantine

An email held in quarantine can be searched for and released.

Depending on the available functions, the sender may be permanently allowed at the same time as the message is released.

More information:

https://www.green.ch/en/manage-hosted-exchange-quarantine

https://www.green.ch/en/hosted-exchange-release-email-in-edgepilot

https://www.green.ch/en/hex-quarantine

 

Further Information

https://www.green.ch/en/hex-everything-about-spam-and-quarantine

https://www.green.ch/en/spf-dkim-and-dmarc-explained

https://www.green.ch/en/dkim-and-dmarc-at-green

https://www.green.ch/en/what-to-do-about-so-much-spam

https://www.green.ch/en/what-is-spam

 

Note: If an email still cannot be found after checking the Junk or Spam folder, quarantine, rules, forwarding settings, the allowlist and the blocklist, further technical analysis may be required. In this case, contact Support and, if possible, provide the sender address, recipient address, date, time and complete non-delivery report.