Why is the Spam Keyword Checking blocking legitimate emails?

Overview

The Spam Keyword Checking filter is blocking valid emails from reaching the users' mailbox. The quarantine details shows: Block reason: Found word (s) check out in the Text body.

Solution

In order to determine why the email was blocked, you can follow the steps described in the "Determining why Spam Keyword Checking blocked or allowed a message" article. By following the steps in the "Scenario 2: Email was blocked by the module" section of the linked article, you will be able to identify what word or words triggered the filter, from the ..\GFI\MailEssentials\AntiSpam\DebugLogs\ase_keyword_checking.gfi_log.txt log file. Look for a block similar to the one below, and make a note of words in question:

"ase_keyword_checking","Found word(s) in subject"
"ase_keyword_checking","Found 4 words: [100% risk free check out risk free]"
"ase_keyword_checking","Setting actions data ..."
"ase_keyword_checking","Spam detected, Stopping ASE Chain [2]..."

Once you find the word or words, that triggered the filter, you can simply remove the rule from the filter, by following this guide.

If you trust the sender you can always whitelist it, by following the steps described in the "Setting up a Whitelist" article. Please make sure that the Whitelist is above the Spam Keyword Checking filter in the Filter Priority List, in order to properly allow the whitelisted email to reach.

Testing

After whitelisting the sender or removing the term, valid emails should no longer be blocked.

If the issue still persists, please generate the troubleshooting logs as follows:

• Make sure that you have tracing enabled.
• Wait for at least 30 minutes to gather enough information and for the issue to be reproduced.
• Run the troubleshooter:
  1. Start > Programs > GFI MailEssentials > Troubleshooter
  2. Follow the Log Generation Wizard for collecting the required and pertinent information.
  3. Select New Case when completing the log generation to attach the logs to a new case that will be automatically created, or open a support ticket manually and attach the logs to that ticket, so that the Support team can investigate the problem.