Skip Navigation
Expand
Troubleshooting Spam and Ham Quarantine Emails
Answer ID 12337   |   Last Review Date 08/18/2023

Why are some legitimate emails being quarantined as spam?

Environment:
Email, Spam management, Ham (desired not-real-spam email)
 
Issue:
Legitimate emails are being caught in spam quarantine which need to be released to create or update incidents.  This is causing delays in email communication with customers.  Ham email is email considered good or not-spam.
 
Resolution:.
Emails sent to Oracle-hosted service mailboxes (either directly or from SMTP forwarding) are received by our Email Security Appliance which includes spam, virus and other security checks.  
 
An email can be quarantined as spam based on reputation scores from various parts of the email, such as URLs included in the email body, sender reputation, sender IP reputation, etc.  Reputation can change with time and depends on complaint rates, message volume statistics, and data from public blocklists and open proxy lists.  Reputation helps to differentiate legitimate senders from spam senders.  There is no configuration for spam confidence levels and our Email Security Appliance vendor releases no information about scoring of emails for spam.  
 
Emails released from spam can be inspected to see if any email domains or URLs have a poor or less-than-favorable reputation using:  https://talosintelligence.com/reputation_center .  This is the same platform used by our Email Security Appliance. 
 
If an email domain or web URL has a less-than-favorable reputation, you can create a Cisco Login and submit a Web Reputation Support Ticket, Sender IP Reputation Support Ticket, or Sender Domain Reputation Support Ticket.
 
If emails for existing incidents are caught in spam quarantine (contact replies to agent or automated response emails), the email can include content from agent responses.  Best practices for email includes keeping the response pertinent to the task of addressing the contact's issue and not including extraneous or marketing information which could make important service emails appear more like spam and therefore affect deliverability.  
 
Emails caught in spam quarantine that are released and create new incidents can be submitted to the Email Security Appliance vendor by following Reporting spam or malware in incidents created by email