Train and release a false positive

A false positive is a message the filter stopped that should have been delivered. Releasing it fixes that one message. Training tells the filter the message was legitimate, which is what changes how it treats similar mail from then on.

Training from quarantine

The quickest route is the message itself. Open it from the log search as described in releasing a message from quarantine, and use Release and train from quarantine either from the preview or from the More actions menu. The message is delivered, and the filter records that its decision was wrong.

Do not use plain Release from quarantine for something you expect to see again. It delivers the message and leaves the filter believing it was right, so the next one from the same sender is held the same way.

A quarantined message opened from a report. A Quarantined Message badge and a spam tag sit above the subject, which reads Wondering where the one you love is, iTagPro knows. The from and to addresses are redacted. Tabs below offer Plain, Normal and Raw. An Actions menu at the top right is open and offers Release, Release And Train, Blocklist Sender, Allow List Sender and Remove. The message body is a dark image with a large yellow button reading Claim your 70 percent off. — The same message the report listed, opened from its subject. Release and train is the second item, and it is the one that changes what happens next time.

Training from the original file

Some messages never reach quarantine. A message that was rejected outright, or one that a colleague has already deleted, still has a copy in the recipient's mail client, and that file is enough.

Open Incoming and Train messages. The page takes files of type MSG, EML or TXT, up to five megabytes per message, and you can drop several in at once. Then choose what the messages are, either legitimate or spam, and continue. The last choice decides which way the lesson points. Training a message as spam is how you teach the filter about something that got through, and it uses the same page and the same upload.

The Train Messages page. Step 1 reads Upload message(s) above a drop zone that says Drop files to upload, or browse, with a note that the file types are MSG, EML and TXT and the maximum size is five megabytes per message. Step 2 reads Train uploaded message(s) as, with two choices, Legitimate message(s) and Spam message(s), each with a line of explanation, and a Continue button below them. — Train messages. The uploaded file is the original message, and the two choices decide whether the filter should trust the sender more or less.

The file has to be the original message rather than a forward or a screenshot. A forwarded copy has your own headers on it, and training on those teaches the filter about the wrong sender.

What training can and cannot do

Training adjusts the classification of similar messages. It is not a command, and it does not create an exception for one address. That is the difference from an allow entry, which is immediate and absolute.

For one supplier who is being caught unfairly, an allow entry is the honest tool and whitelisting a sender covers it. For a pattern, a class of message, or a run of similar mail from several addresses, training is what improves the filter for everything that comes next.

Train in batches, and watch the result

A single message moves the filter a little. Ten messages of the same kind, trained in one visit, move it enough to notice. Where a whole campaign was misjudged, collect the copies before deleting them and upload them together.

Then watch the quarantine for a few days rather than for an hour. Classification changes show up as a slow drop in the number of good messages being held, and the log search is where that shows first. If the opposite happens, and the filter starts holding mail from senders it used to accept, a message was probably trained as legitimate when it should not have been, and the history of what was trained is worth checking before changing anything else.