Summary:

If a message should have passed through DAS and been delivered to an internal or external recipient, it is a false positive. It is critical that these messages be forwarded to the Tumbleweed Message Protection Lab for the function of your DAS server in your environment. Often we find that even a single word or phrase can generate several false positives a day, and tuning even one term in the DAS filter can dramatically alter the False Positive rate experienced by your DAS implementation going forward.

Resolution:

Messages that are incorrectly marked as spam or other categorization errors should be submitted to spamlab.fp@tumbleweed.com. False positives may be submitted by adding this address as a blind carbon copy (BCC) recipient to the message or by attaching the message to a new message as described in the previous section. However, you should not apply the message attachment related policy if you create an EMF user record for the false positive reporting address.

EMF administrators who are reviewing the quarantine queue using EMF Web Admin should submit the message by clicking the button labeled SMTP Recipients. This will open a small pop-up window in the browser. The pop-up window allows you to add another SMTP recipient to the message. This is where you should add spamlab.fp@tumbleweed.com just prior to releasing the message to the recipients. Adding a recipient here affects the envelope of the message only. The new recipient is added as a BCC recipient of the message. The original recipients will be unaware that the Message Protection Lab address has been added to the message.
The alternative solution is to save the false positive messages to disk files using the Save Message to File button in Web Admin. These files can then be attached to a new email message (using any SMTP client application) and sent to spamlab.fp@tumbleweed.com.