Can you send me the Suspect Spam tracker on a PM? Please don't post it to this thread. I'll see if I can find out why they are being caught.

From my understanding though, whitelisting should bypass suspect spam verdicts... so I'm wondering if something is changing in the content of the message and we are not flagging the allow list.

Does Message tracking say it tested against the allow list? It should come back as having the allowed verditc as well.

Thanks!

Thanks Tom, sent you a PM

 Hi Doni,

Not sure if you can do what you want, you are trying to add a hostname to a domains list and I think that's what the problem is. Check to see if the hosted provider can provide you a range of IP's this should be possible, and then add them to the Good Senders IP based allow list.

If you are getting some Suspected Spam FP's then our suggestion would always be to raise your Suspected Spam threshold...

Kevin

Thanks for the suggestion Kevin, I've asked for the IP addresses and am awaiting a response. The problem with IP-based whitelisting is that IPs are often subject to change, esp with a hosted service with a large SMTP farm. Hostname is always a better option. I've also whitelisted by full domain, but it may be that it only checks the sender FROM header domain, which in this case won't match the SMTP server's domain so won't help. TomC is working with me offline, so hopefully we'll figure out the best solution shortly.

Looks like the discrepancies I was seeing in IP addresses were due to some (new?) gateway on their end. So I now have it whitelisted by confirmed IP addresses. Of course, I'd still like to know for sure how to do this by SMTP hostname, which should be possible.

Just an update, while I discuss offline with Tom. Will post back with any concrete answers. Thanks

Good idea, thanks Kevin. Still a bit odd that you can't easily whitelist by SMTP server name -- guess I never realized this, should be a standard feature -- but that sounds like a good solution. Appreciated.

Btw, Are you on the Brightmail team? I read a lot of "we"s but don't see a "Symantec Employee" flag. Just curious... Thanks again.

Thanks for following up on this Kevin. I ended up having to do jury duty yesterday so I was unable to follow up with Doni.

So sorry about that Doni! Sounds like we have a good as possible resolution here so glad we progressed.

Yup, Kevin is one of our Brightmail superstars here at Symantec.

Ah, thanks for the clarification. You and Tom should drag Kevin into an intervention to force him to wear a "Symantec Employee" tag. :-)

Guess my secret is out, yes indeed I am a Symantec employee, and no I'm not embarrased to be one :)

I registered to the forums using a personal email account, I should probably reregister with my Symantec account.

Kevin