This article describes how to notify Microsoft when the Microsoft Advanced Spam Manager or Forefront Protection 2010 for Exchange Server (FPE) does not identify an unsolicited commercial e-mail message as spam. This is also known as a false negative. Additionally, the article describes how to notify Microsoft when the Advanced Spam Manager or FPE incorrectly identifies a legitimate e-mail message as spam. This is also known as a false positive.

It is most effective to report spam messages as you receive them during the day or night. You must not archive spam messages and then release them one time per day or one time per a week. Most spam messages are time sensitive. If the submissions occur throughout the day, Microsoft can respond to spam messages in a timely manner.

Submitting false positives and false negatives to Cloudmark

To submit a false positive or false negative spam e-mail message to Cloudmark, send the e-mail message as an RFC 2822 attachment (.eml). Do not send misclassified messages by using the Forward command. The Forward command strips the messages of essential header information and results in an invalid submission.

False positives (legitimate e-mail messages marked as spam by Cloudmark) should be sent to the following e-mail address:

Forefront-legit@submit.cloudmark.com

False negatives (spam not detected by Cloudmark) should be sent to the following e-mail address:

Forefront-spam@submit.cloudmark.com

Note To attach an e-mail message as an RFC 2822 attachment, follow these steps:

1. In Microsoft Outlook, create a new e-mail message.
2. Address it to the appropriate address.
3. Click the Attach Item button, select the e-mail messages that were falsely classified, and then click OK.