Skip to end of metadata
Go to start of metadata

The following topic explains how to find emails that have been wrongly classified as spam or another generally unwanted or malicious category.

Please report such incidents to when you feel the email should have been classified as clean or as a legitimate newsletter.

To find a blocked email:

  1. Login to the Cyren Web Security Portal as an administrator.

  2. Locate the Email in the email report by navigating to Reports > Email > Tracking Log, and use the filters to locate the email to ensure it was sent to Cyren and to understand what action was taken by Cyren Email Service (CES).

    If filtering by the Sender or Recipient field, be sure to enter the entire domain name. You can also filter by the Action taken by Cyren if you know it.

  3. Click Show.

  4. Click next to the individual entries to expand the transaction. 

  5. Review the steps taken as the transaction progresses. 

    Scroll right on the Mail actions taken to understand what action was taken and why.

  6. Check the Email policy by navigating to the Email Protection Incoming > Rules. Ensure the rules in place follow the intended policy for the email in question. For example, the email was sent to, which falls within above rules under the “Security” policy. 
  7. Click Policy Sets tab, and check to see how the email was handled, for example, Reject, Quarantine, Forward, Tag or Deliver, based on the category that the email in question was classified (for example,Spam, Malware, Clean and so on).  

  8. Make adjustments to the policy set if needed (if the email is categorized incorrectly see step 9). 

    If you are looking for an email in “Quarantine” but cannot find it, ensure that there is a setting for that type of email to be quarantined.

  9. Send an email to a Cyren Spam Analyst by sending a copy of the ORIGINAL email (if you can get it) as an attachment or an .EML file to with a subject line “Please unblock the attached email”.

    The original email is required and NOT a forwarded email, as inspection on the header is necessary for our Detection Department to review.  If sending the original email is not possible then send the “Internal ID” of the email to with the subject line “Please unblock the attached email”. The Internal ID is located in the expanded view of a transaction.

The FP reporting address is monitored 24/7 by our spam analysts. You will receive an answer to your report within 24 hours. Should you have any questions or feel your report wasn’t handled properly, please send an email to

  • No labels