Spam FAQs

Q: How does the system work?

A: This system will tag any messages it thinks are spam with a [SPAM+] tag on the subject line. Those of you on the consolidated Exchange e-mail server (http://dcos.uth.tmc.edu/email.htm/) will have these tagged messages automatically moved into your Junk E-mail folder. You will need to check your Junk E-mail folder to see these messages. Those of you not on the consolidated Exchange e-mail server will have to configure your e-mail clients manually to move tagged messages into your Junk E-mail folder.

The Helpdesk is available to assist you with your technical support questions at x4848.

Q: What about the spam filtering capabilities of my e-mail client?

A: We suggest that you turn off any anti-spam filtering in your e-mail client and not try to use that in conjunction with the automated Brightmail filtering. The built-in anti-spam features of your e-mail client are much less sophisticated and prone to a higher false-positive rate than the university service. For instructions on how to turn this feature off in Outlook 2003, click here.

Q: What about the old anti-spam systems?

A: Both of the old systems (GFI and Spam Assassin) are being disabled. Those users on the consolidated Exchange system who were seeing the [SPAM] tag on potential spam messages will not only get a more accurate [SPAM+] tag on their messages, but they will also have these messages moved for them automatically into their Junk E-mail folder. Users who are not on the consolidated Exchange server who followed the previous instructions to configure their e-mail client to use the Spam Assassin product e-mail headers will have to reconfigure their client to move the [SPAM+] tagged e-mail into their Junk E-mail folder.

Q: How do I report false-positive and false-negative spam messages to Symantec Brightmail?

A: Occasionally, the Brightmail Anti-Spam engine in the IronPort C-Series appliance will improperly mark a message as spam when it is not ("false positive") or miss spam messages ("false negative"). Your assistance in identifying false positives and false negatives is essential maintaining the efficacy of Brightmail.

Symantec provides two email addresses specifically to receive false positive and false negative reports.

Messages that have been scanned by Brightmail and resulted in false positives should be sent with all headers to gfeedback@feedback-1.brightmail.com.

Messages that have been scanned and are false negatives should be sent, with all headers, to gsubmit@submit-1.brightmail.com.

Important - You must send FULL HEADERS and BODY in the message as a RFC-822 MIME encoded attachment when submitting messages to these addresses. Symantec must receive false positives and negatives within 24 hours from the date initially sent to effectively write rules and filter the spam.

Here are instructions for sending messages in acceptable format to the BLOC (Brightmail Logistics and Operations Center) in Microsoft Outlook and Netscape Messenger.

Microsoft Outlook -

• Under the "Tools" menu select "Options."
• Under the "Preferences" tab, press the "E-mail options ..." button.
• On the bottom half of the window, under "When forwarding a message" select "attach original message" from the drop-down menu.

Note - You may also use the BrightMail Outlook Plug-in which, when
installed on a client, will automatically forward all the relevant info
to the BLOC at the push of a button.

Microsoft Outlook Express 5 -

• Select the message you want to submit.
• Click on Message, then Forward as Attachment. You should see an Attach: row under the Subject.
• Address the new message to customer alias for junk. Leave the subject and body of the message blank.
• Send the message. If Outlook warns you that the message has no subject just click OK.

Netscape Messenger -

• 'Right click' on the message you wish to send and select "forward as an attachment."

Note - If you can't see the Brightmail header "X-BrightmailFiltered: true" in the message you're sending to Symantec, then either the message was not filtered through Brightmail or you aren't forwarding all headers. If you don't have all headers available to you because of a defective email client, you should not submit the message to Symantec, as it will not be reviewed.

Q: Where is my missing e-mail?

A: All e-mail is being delivered to you. No e-mail is being blocked. If you have not received a message that you thought you should have, please recheck both your Inbox and your Junk E-mail folders.

Q: Can I have my spam back?

A: Those users who do not like the new spam system will have a one-time opportunity to opt out of having their spam e-mail tagged. In order to take advantage of this opportunity, please send an e-mail from the account you do not wish to have filtered to the following e-mail address: give.me.spam@uth.tmc.edu