False Positive

Question

So what exactly happens when you use the "Release and report false positive" option in Mail Manager?

BAlfson · Answer

I think this is a different question, Doug. This has to do with anti-spam, in particular with ctasd (the CommTouch anti spam daemon). For every incoming email, ctasd calculates a RefID like: 
 RefID:str=0001.0A02020E.5CCF3583.000E,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0 
 This is sent to a cloud server at CYREN (formerly CommTouch) that then compares the RefID to its database of RefIDs of known spams and responds with 'Confirmed' (an almost-perfect match with one), 'Bulk' (a close match), 'Suspect' or 'Unknown'. Bulk is qualified as Spam. Unknown and Suspect are delivered. 
 When one reports it as a false positive, this is relayed to CYREN. I don't know the details of how they use that to automatically update their database. 
 Cheers - Bob