False positives from phish SPF and SPF failure

First, I’d like to say what an excellent product this is. It catches many hundreds of spam emails a day and is a great time-saving tool.

We’re getting a couple of false positives due phish SPF and SPF failure. These emails were sent from legitimate ISP and corporate email accounts. Apart from whitelisting the email addresses, can anything else be done?

It appears the most frequent the quarantine log reports can be sent is once a day. It’d be good if we can increase the frequency so false positives become less of an issue.


Hi kheong,

Thank you for your kind words about our product, we are glad is is helping you.

White-listing is the best option working on a ‘default-deny’ basis. The other options would mean lowing your spam threshold or contacting the owners of the domains that are being blocked/quarantined and asking them to resolve their SPF/DKIM problems.

You can configure ‘quranatined items’ reporting as much as you want. You do this in the domain control panel in the Manage report subscriptions section. Quarantine report is the area you are looking for.


Thanks for the reply!

With the quarantine reports, what I meant is the quarantine reports sent to the user rather than the administrator. It appears the most frequent user reports can be sent is once a day.


Not at all :slight_smile: If you go into your domain control panel, ‘Manage report subscriptions’ area, ‘Quarantine report’ section you have can (working from left to right, select to have reports sent every hour, or any hours you choose, have the sent every day, or whichever days of the week you choose and can choose only week-days or select specific days. You can also choose whether your users should receive empty reports.

This section of the guide may help you > Manage Report Subscriptions for Selected Domain, Email Security | Comodo Antispam

Kind regards,

I’m confused… I thought this sets the reports for the administrator.

The help manual states “The Manage report subscriptions interface accessible from the ‘Incoming’ configuration area of a selected domain allows the administrator to configure the subscription to the periodical Domain and Quarantine summary reports of that domain only for the administrators.”.

I assume only administrators would be entered in the “Report recipients” field in this dialog box…