This document explains the Symantec Cloud Email Security Newsletter / Marketing Detection option in the AntiSpam service. It explains the difference between spam emails and newsletter/marketing emails, the options for actions to take on such emails and frequently asked questions.

Definitions

Spam is defined as unsolicited bulk email (includes unsolicited commercial email).  With Symantec Cloud Email Security, such emails are intended to be detected by:

• Spoofed Sender Detections (SPF and DMARC)
• Responsive Spam Detections (blocked senders, dynamic IP block list, signaturing system)
• Predictive Spam Detection (Skeptic heuristics)
   

Newsletter is defined as email messages that include content on specific topics, on a known periodic basis, often weekly or monthly. The user may have requested to receive these publications. A functional opt-out facility is generally available.  This type of email would be detected by:

• Newsletter / Marketing Detection
   

Marketing is defined as email messages that contain commercial or fund-raising messages, that may have been requested by the user. These messages often do not include a functional opt-out facility. This type of email would be detected by:

• Newsletter / Marketing Detection
   

We originally implemented newsletter detection as a subset to our Skeptic heuristics. The only option was to enable/disable this subset and the applied action would match the action taken for Skeptic heuristics.  Newsletter / Marketing Detection is now a separate detection method, appearing below Skeptic Heuristics and an action can be selected independent of actions for the spam detection methods.  Like the spam detection, your options are:

• Append a header but allow the email through
• Append a header and redirect the email to a bulk mail address
• Block and delete the email
• Tag the subject line but allow the email through
• Quarantine the email

Full details on these actions can be found in this article: Action options in Email Security.cloud AntiSpam service.

Frequently Asked Questions

Q: What can be done if a "false positive" occurs?
A: Symantec does not consider this as a true false positive. The Newsletter / Marketing ruleset is an optional features that customers opt into at their own discretion. If you encounter such a “false positive”, you can do any of the following:

• Create and add the user to an AntiSpam group and disable Newsletter / Marketing detection for the group.
• Disable the feature globally
• Add the parent domain of the Envelope Sender address to the Approved Senders list either globally or for an individual user.
   
  • This must be the Envelope Sender as seen in the X-Env-Sender or Return Path header lines, or as seen as the sender in Email Track & Trace.  This cannot be the Body From address as seen in the mail client.  (eg. [email protected])
  • This must be the parent domain.  For example, if the newsletter sender was 1[email protected], then you need to approve example.org as the sub-domain will generally be different each time.
  • Be aware that this approves all newsletters from this newsletter sending service.  It is not possible to Approve individual newsletters as there is no way for the service to differentiate.

Q: How can I test the new dispositions?
A: Check Test the Email Security.cloud AntiSpam service.

Q: How can I submit newsletter/marketing URL messages to Symantec?
A: Please submit using the False negative submission tool in Client net under Tools > Email submissions.

Also see Spam email missed (False Negative) in Symantec.cloud , while Symantec makes best effort to incorporate the valuable feedback into filter creation process, Symantec does not guarantee a filter creation for each submission made into respective addresses. Please note that submissions should go to respective addresses, depending on type as defined above. Also note that there is no feedback provided for such submissions.