Email - Understanding Suspected Spam Emails

Summary

Information about suspected spam emails, including examples and how to handle false positives.

Body

Summary

Even though an email may appear to come from an @ku.edu address, many mass mailers use third-party services outside of KU that make it look like the message originates from KU. In reality, these emails are sent from a completely different domain.

See article: Email - Handling and Reporting Suspicious Mail and Microsoft Outlook - Setting Safe Senders for more information on how to report suspicious emails and how to edit settings in Outlook, if an email was incorrectly marked as spam.

Note: The Safe Senders list only ensures that emails are delivered to a user’s inbox instead of their junk folder. It does not prevent the system from adding [KU Suspect Spam] to the subject line if the email is flagged as potentially suspicious.

Reference Items

Email - Handling and Reporting Suspicious Mail
- How to report suspicious and spam emails.
IT Help Desk
- Contact and support for issues with email.
Microsoft Outlook - Setting Safe Senders
- Changing settings in Outlook to trust email senders and domains.

[KU Suspect Spam] in the Subject of an Email

Emails can be flagged as a spam suspect by the KU filtering system for several reasons. Spam filters analyze multiple elements of an email, including but not limited to:

From & Sending Address (checking for discrepancies)
Subject line
Body content (including links)

For example, a user added HealthQuest as a Safe Sender. The message was still tagged as [KU Suspect Spam], but it was delivered to the inbox.
Microsoft assigns spam scores ranging from 1 to 9:

0 = Extremely low probability of spam
9 = Extremely high probability of spam
Any message scoring 5 or higher will likely trigger the spam filter.

Examples of False Positives

Legitimate organizations sometimes use bulk‑email or mass‑mailing services to distribute newsletters, notifications, or program updates. Because these messages are sent through third‑party mailing systems rather than directly from the organization’s official email address, they can occasionally trigger spam‑filtering rules.

Even when the content is legitimate, certain characteristics—such as high‑volume sending, external sending domains, or marketing‑style formatting—may cause an email to be incorrectly marked as spam (a false positive).

To reduce these occurrences, users are encouraged to add trusted senders to their Safe Senders list. While this does not override every spam‑filtering rule, it significantly improves the chances that legitimate messages will be delivered directly to the Inbox.

Spencer Art Museum

Why This Email Was Sent to Junk Despite Safe Sender Settings?

The example email appeared to come from the Spencer Museum of Art (spencer@ku.edu). Although spencer@ku.edu was added to the recipient’s Safe Senders list, the message was still delivered to the Junk folder.

This occurred because the email was not actually sent from the spencer@ku.edu address. Instead, it originated from a .net sender address, which the spam filter evaluated as suspicous. Safe Sender rules only apply when the message is sent directly from the approved address. When the true sending address does not match, normal spam filtering rules still apply, which can result in the email being flagged and placed in the junk folder.

Copy of the email received:

This is because the email was sent by a distribution service who is impersonating the Spencer Museum of Art in order to send the email on their behalf.

Analysis of the message header shows the true sending email address.

When we review the technical details, we see that the email:

Actually originated outside of KU.
Since the sender is actually not spencer@ku.edu, simply adding that email address to your Safe Senders list will not guarantee delivery.
You would need to add the actual sending address (the third-party domain) to ensure it reaches your inbox.

If you need help identifying the true sending address in item C above, please contact the IT Help Desk.

Marathon Health (HealthQuest)

Why This HealthQuest Email Was Marked as Spam?

The email in question was sent by HealthQuest, a partner of the State of Kansas healthcare plan. Although the message was legitimate and related to an approved business purpose, it was still flagged as spam by our email security system.

Spam filters operate based on a set of automated rules. Because this email originated outside of KU and contained characteristics commonly associated with spam, the system correctly categorized it as potentially suspicious. This automated behavior helps protect users from unwanted or harmful messages, even when an occasional legitimate email is caught in the process.

Copy of the email received:

Analysis of the message header shows that while system marked this email as spam, Safe Senders settings delivered the message to the recipient's inbox.

The Spam Score assigned to this message was 5.

Article Changelog

4/22/2026

All article image alt-text updated.

Details

Article ID: 21647

Created

Thu 1/15/26 12:17 PM

Modified

Tue 9/1/26 3:01 PM