Select your language

Spam Filter Set Too Strictly

Note: This help article applies only to Hosted Exchange. If you are not sure which email service you use, you can find more information in the following article.

https://www.green.ch/en/which-email-service-do-i-use

 

Hosted Exchange uses multi-layered spam and threat protection. Incoming messages are assessed according to various criteria. These include the reputation of senders and IP addresses, SPF, DKIM and DMARC checks, embedded links and attachments, sending patterns and other security characteristics.

If an expected email is incorrectly identified as spam, moved to quarantine or blocked, the spam filter settings can be reviewed and adjusted.

 

Review and Adjust Spam Filter Settings

  1. Sign in as an administrator.
  2. Open the spam filter management section.
  3. Review the active spam filter and security policies.
  4. Check whether messages are being blocked or moved to quarantine due to the current policies.
  5. Adjust the settings carefully and test the effects with a new email.

More information about managing the spam filter:

https://www.green.ch/en/how-do-i-manage-my-spam-filter-in-edgepilot

https://www.green.ch/en/hosted-exchange-spam-filter-policies

 

Make the Spam Filter Less Strict

If legitimate messages are regularly identified as spam, the spam filter policy can be adjusted.

  1. Sign in as an administrator.
  2. Open Email Threat Protection.
  3. Go to Settings.
  4. Open the Spam Filter Policy tab.
  5. If automatic policy management is active, click Manually Manage Policies.
  6. Open the Weight Check section.
  7. Disable the sliders for Weight10 and Weight15.
  8. Click Save.

This adjustment makes spam filtering less strict. As a result, legitimate messages may be delivered directly more often.

 

Check Quarantine

If a message is not delivered, check quarantine first.

The spam filter can accept messages and move them to quarantine instead of delivering them directly. In this case, the message has not been lost but has been held back by the spam filter.

  1. Sign in as an administrator.
  2. Open Email Threat Protection.
  3. Select Quarantine.
  4. Search for the affected message.
  5. Select the message.
  6. Click Release.

Depending on the configuration, messages can be released and senders can be permanently allowed.

More information:

https://www.green.ch/en/manage-hosted-exchange-quarantine

https://www.green.ch/en/hex-quarantine

 

Check the Allowlist and Blocklist

Allowlists and blocklists can contain email addresses, domains or IP addresses and affect delivery.

Check in particular:

  • whether the affected sender was accidentally blocked
  • whether an entire domain was blocked
  • whether an allowlist rule already exists
  • whether existing rules affect delivery

In the Filters section of Email Threat Protection, you can:

  • allow individual email addresses
  • allow entire domains
  • block individual email addresses
  • block entire domains

 

Use Email Logs for Analysis

Email logs help with the analysis of delivery problems.

The logs show, among other things:

  • received messages
  • sent messages
  • rejected messages
  • the time of processing
  • spam and security assessments

This often makes it possible to determine whether a message was delivered, rejected or processed by the spam filter.

The logs only record messages to or from external domains. Messages within the same Hosted Exchange organisation are not visible there.

More information:

https://www.green.ch/en/hex-logs

 

Typical Causes of Messages Being Incorrectly Identified as Spam

  • The sender or their domain has a poor reputation.
  • SPF, DKIM or DMARC checks fail.
  • The message contains suspicious links or attachments.
  • An entry on a blocklist affects delivery.
  • The message was moved to quarantine.
  • A rule moves or blocks the message.
  • The sender uses an incorrect mail server configuration.
  • REVDNS, RETURNPATH, ROUTING or HELOBOGUS indicate technical problems on the sender’s side.
  • ARGDBL, SPAMDOMAINS or similar reputation checks increase the spam score.
  • PHISHING, PHISHURL or SPEARPHISH identify suspicious content.
  • HTMLSCRIPT, HTTPREDIRECT or IPINURL are identified as suspicious characteristics.
  • WEIGHT20 or WEIGHT30 exceed the defined spam threshold.

More information about SPF, DKIM and DMARC:

https://www.green.ch/en/spf-dkim-and-dmarc-explained

https://www.green.ch/en/dkim-and-dmarc-at-green

 

Meaning of Common Spam Tags

Spam tags show which checks were triggered for a message. A single tag does not automatically mean that a message is spam.

Common with Newsletters

  • BULKMAILER: Bulk sending through a newsletter system.
  • OPTOUT: Unsubscribe link present.
  • WEBBUG: Tracking pixel present.
  • COMMENTS: HTML comments detected.

These characteristics are common in legitimate newsletters and normally do not lead to blocking on their own.

Sender Authentication

  • SPFHARDFAIL: SPF check definitively failed.
  • SPFSOFTFAIL: SPF is probably incorrect.
  • DKIM: DKIM check failed.
  • DMARC: DMARC check failed.

Failed authentication checks significantly increase the spam score and may lead to quarantine or blocking.

Technical Characteristics

  • REVDNS: No reverse DNS available.
  • HELOBOGUS: Invalid HELO or EHLO information.
  • RETURNPATH: Suspicious or incorrect return path.
  • ROUTING: Suspicious routing information.

 

Further Information

https://www.green.ch/en/hex-everything-about-spam-and-quarantine

https://www.green.ch/en/manage-hosted-exchange-quarantine

https://www.green.ch/en/how-do-i-manage-my-spam-filter-in-edgepilot

 

Note: If a message is still not delivered after checking quarantine, the allowlist, the blocklist, the spam filter policies and the logs, contact Support. If possible, have the sender, recipient, date and time of the affected message available for analysis.