Even though the Hornetsecurity spam filter has a recognition rate of 99.99%, you might experience from time to time that some emails will be filtered incorrectly. These emails are referred to as:

  • False Positive (FP): Valid e-mail will be accidentally filtered
  • False Negative (FN): E-mail wasn’t filtered through the spam filter


This article describes how to report false negatives and false positives. There are several possibilities:


Control Panel

It is possible to report FP/FN at any time using the Control Panel and might even be necessary if certain categories cannot be released from within the spam report, such as Virus emails. You can set the appropriate categories when setting up the spam report.


You can report any FP/FN from within the workspace. For further information on how to report emails, please refer to the Control Panel handbook.


Report as forward (False Negative and False Positive)

  • False Negative -> false-negative@hornetsecurity.com
  • False Positive -> false-positive@hornetsecurity.com


The FP/FN must be sent as an attachment in the ".eml" format to the above mentioned addresses.


Outlook Add-In (False Negatives)

As far as possible, any False Negatives should be reported through the Outlook Add-In using the appropriate button. When reporting through the Add-In, the spam filter will be adjusted as soon as the information has been analysed. Reporting the email via Add-In has the advantage, that it will automatically provide any information required to analysis.


Spamreport (False Positives)

To allow quick reaction time, we recommend setting up a spam report for the users. Through the spam report, users can release specific emails by simply clicking on the email. Once released, the user will receive a reply through the browser.


Advanced Threat Protection (False Positive/False Negative)

For a detailed analysis, Hornetsecurity requires the affected email as an ".eml" file. This does apply to any mechanism of the ATP service. Should you encounter such a behaviour, please open a ticket with our technical support, providing the affected ".eml" file.


Reporting via ticket

If using any of the above-mentioned methods, it is not necessary to separately report any FP/FN to Hornetsecurity. Any reporting option will forward the information automatically and it will be used to adjust the spam filter appropriately.

If there is no improvement of the spam filter (please wait at least 48 h until an adjustment has been made), please contact our Support. For this you need to ensure, that the following necessary information is provided:


  • customer domain (e.g. hornetsecurity.com)
  • Date (e.g. 01-01-2019)
  • Sender (e.g. test123@hornetsecurity.com)
  • Recipient (e.g. test456@hornetsecurity.com)
  • Subject (e.g. “Urgent matter”)
  • Customer verdict: False Positive / False Negative
  • Customer reason (Why should this email be classified differently?)


With the information mentioned above you can contact our technical support.