Recognition of emails by the Cyren AntiSpam filter

The filter “Cyren AntiSpam” is available if NoSpamProxy Protection is licensed. This filter does the main work of checking emails for spam regarding content and structure of the email. It generates a Reference ID, which is sent to Cyren when an email is received and checked against a database. If this check reveals no characteristics of spam emails, the email will be accepted. Otherwise, the filter assigns 4 SCL (Spam Confidence Level) points, which in the default settings already rejects the email.

In order to continuously improve the recognition of emails of this type, we have the option of reporting to Cyren emails that have not been recognised as spam or have been incorrectly recognised as spam as false negatives or false positives. To enable us to do so, please send us the necessary information – as indicated below – to the email address spamreport@nospamproxy.de.

Please note:

• Do not keep emails stored and please do not send us ZIP archives.
• The false positives and false negatives should always be reported promptly so that further delivery attempts are filtered correctly.
• Reports should not be older than 7 days.
• Before forwarding, please check whether the unwanted e-mail is really spam or perhaps a newsletter from which you can unsubscribe via a link or possibly comes from a mailing list with which you are registered and from which you can/must be removed

False Negatives

These are unrecognized spam emails that were delivered by NoSpamProxy in spite of all checks.

• For the analysis of false negatives, please send us the original email as .eml or .msg files, as it arrived at the recipient’s mailbox, as a direct attachment to a newly written email.
• It must not be an internally forwarded email, since the headers of the email may no longer be complete, or changed.

False Positives

These are desired emails that have been classified as spam and have therefore not been delivered, but rejected.

• Please send us the exported message track from message tracking. To export it, go to the NoSpamProxy console under “Monitoring > Message Tracking”, double-click on the corresponding entry so that the details of the message open, and then click on “Export message track” in the bottom left corner of the window. This will save a .XML file up to version 11.1 and a .JSON file from version 12.0. Please send us this exported file.
• If Cyren AntiSpam is the only filter that takes effect and the partner domain has an applicable trust greater than 50, the email will still be delivered because the trust rating is sufficient. As soon as other filters are added, this is no longer possible.
• Starting with version 13, you also have the option of activating the file directly from the NoSpamProxy console. To do this, go to “Monitoring > Message Tracking” in the console, mark the corresponding entry in the message tracking and then click on the link “Report as ‘False Positive’ to Cyren” below the list.
  The activation can take several hours. If after one day the e-mail is still blocked, please send the exported message track and the original e-mail to spamreport@nospamproxy.de.

More information

• For information about detection by the Cyren Premium AntiVirus, see the Knoweldge Base article Attachment detection by Cyren Premium AntiVirus
• For information about detection by the Cyren IP Reputations filter, see Knowledge Base article Detection of IP addresses by the Cyren IP Reputation filter
• For information about detection by the Cyren URL classification service, see the Knowledge Base article How to influence URL classifications
• Troubleshooting information for all Cyren services can be found in the knowledge base article Cyren Engines – Troubleshooting