Check the following:

• Make sure that ALL DNS MX records are redirected to the correct TMEMS MX records. Otherwise, MX records that are not redirected to TMEMS may directly receive mails that are not scanned by TMEMS.
• If a corporate firewall is present, configure the firewall to only allow SMTP traffic coming from TMEMS IP ranges as follows:
  • 18.208.22.64 /26
  • 18.208.22.128 /25
  • 18.188.9.192 /26
  • 18.188.239.128 /26
• Increase the "Aggressiveness" of the Dynamic IP Reputation Settings in the TMEMS console under Inbound Protection > Connection Filtering > IP Reputation > Settings. For example:

  

  ^{Click the image to enlarge.}

  

  ^{Click the image to enlarge.}

• TMEMS subscribers can increase the spam sensitivity level of "Spam or Phish" policy. To do this:
  1. Log on to the TMEMS console.
  2. Go to Inbound Protection > Spam Filtering > Spam Policy > And Message Attributes Match.
     • Make sure that the mail sender address of the spam is not in the Approved Senders list of the receiving domain. Approving a sender allows mails coming from the address to bypass ERS and content-based spam scanning.
     • Make sure that the mail sender address of the spam is not in the Web EUC Approved Senders list of the recipient.
     • Make sure that the mail sender address is not in the Exceptions of the Spam or Phish policy.
     • Make sure that the "Spam or Phish" policy has either Delete or Quarantine action.
     • Receive emails only for valid recipients by using Directory Management or Active Directory Sync Client.
  3. Block the sender by using Blocked Senders under Inbound Protection.
     • Valid formats:
       • *@example.com
       • *@server.example.com
       • *@*.example.com
     • Invalid formats:
       • *@*
       • *@*.com
       • name@*.example.com

If the issue persists, submit spam samples to Trend Micro Support:

• Spam Submission Guidelines:
  • The spam sample should be in .msg or .eml format.
  • The spam sample should be the original mail, not forwarded mails, since forwarded mails do not contain the original email contents and may contain customer-related information that could lead to False Positives. Original Spam Mail can be obtained by following the steps below:
    1. Create a folder.
    2. Drag all undetected spam samples to the created folder.
    3. Place the undetected spam samples in a zip file and password-protect it using the word "novirus" (without the quotation marks).
    4. Send the zip file.
• Available Channels for Submission:
  • To submit false positive or false negative spam samples, contact Trend Micro Technical Support.
  • To nominate a known spam source IP to ERS, visit the MAPS Lookup Tool.