Train spam filter for legitimate payment notification emails being blocked

draft · accounts-and-access spam-filteremail-whitelistspam-training

Generated by docuprocessor (prompt article/v3) · 2026-04-22 11:16

Source thread

thread_id: spaces/AAAA05BdS6s/threads/GnOD1kOUAuY · 12 msgs · first 2024-09-20 · participants: Tech ATech BTech C

Tech A 2024-09-20 14:43

so I see it's being marked as spam and there is a "not spam" did you try that?

Tech B 2024-09-20 14:44

Yes,

Tech A 2024-09-20 14:44

yeah looks like we need to train spam filters,, lets see if that helps

Tech B 2024-09-20 14:47

looks like they have been receiving these email even without "marking as valid" before, but will be checking back with her.

image/png image.png

This image is not relevant to equipment diagnostics or technical maintenance. It shows an email client interface displaying automated billing/payment confirmation emails from a service called "Uspay," with a payment of **$146.00** processed on **8/8/2024**, Reference Number **336793837**, associated with account ending in **3256** for a merchant identified as **BRONX-HELEN WEINBERG ORTHO GROUP-BRONX**.

Tech C 2024-09-20 14:50

can we add uspay.com domain to the whitelist?

Tech B 2024-09-20 14:52

I did the notspam trained option.

image/png image.png

The image shows a webmail interface (Uspay/Mailbox) displaying emails from "Automated Billing Email (do not reply)" originating from uspgw@uspay.com (Sender IP: 209.208.32.235 - 127.0.0.1). The visible email subject references **Ref Num: 336771748**, Customer ID: 0180388, dated 08/07/2024 at 1:03 AM, with the subject line prefixed "Spam:**********" indicating it was flagged by a spam filter. The "Not Spam" button is circled in red, and the email is currently open in the preview pane with spam classification controls visible (Spam, Not Spam, Allow Once, Block Forever).

Tech C 2024-09-20 14:55

(no text)

image/png image.png

**MD OFFICEMAIL – ASpam Training Interface (WebMail Port)** The screen displays the **Custom Spam Rule Training** page for account **pdsmgmt@mdofficemail.com**, with two action buttons: **"Test Filter"** and **"Train Filter."** The radio button **"This is spam"** is selected (vs. "This is NOT spam"), and a large empty text input field is present for pasting raw message content with complete headers.

Tech B 2024-09-20 14:55

looks like it was already added on the account as whitelisted

image/png image.png

The screen displays an email client's **Spam Control > Address Whitelist** settings page showing "11 out of 58" existing Friends addresses starting at position 48. A text input field for adding addresses is visible, along with a CSV import option and existing whitelisted addresses including domains such as `@darbydentalsupply.com`, `@amazon.com`, `@pdsmgmt.com`, `@gmail.com`, `@uspay.com`, and `@catholicguardian.org`. The address `vsurujbhan@catholicguardian.org` appears highlighted/selected with a red underline indicator visible beneath it.

Tech B 2024-09-20 15:05

@Sergey Starodub sorry, but this option is on the admin account right, because I dont really see that on the end user option I can only see the options on the screen shot above, and is showing that was added as whitelisted

Tech C 2024-09-20 15:06

yes

Tech B 2024-09-20 15:18

I am doing the ASPAM Training, looks like we need to add the raw body below with the message, does it matter which one goes first, if the message or the complete header, or I can just paste the Raw Body?

image/png image.png

The screenshot shows the **MD OFFICEMAIL ASpam Training interface** for `pdsmgmt@mdofficemail.com`, with a spam score of **sd=4.5** displayed. A raw email header is visible in an overlapping popup window, showing the subject **"Scheduled Payment Error"** from `uspgw@uspay.com`, with the header line **"X-SpamCleaned: Spam manually marked as not spam"** highlighted. The email originated via `mail.bridgepaynetwork.com` (IP **209.208.32.235**) and was received **Thu, 08 Aug 2024 00:04:01 -0500**; the "This is spam" radio button is selected in the training interface.

Tech B 2024-09-20 15:23

(no text)

image/png image.png

The screen displays an **ASpam Training interface** for the account `pdsmgmt@mdofficemail.com`, showing a spam filter training page with a spam score readout: `sd=9.9 NoRule 0.04` followed by multiple weighted rule values including `X-SpamContent:isspam (0.90)`, `X-Phrase:isspam (0.90)`, and `X-triplet:trainbad (0.90)`. The message body visible in the text area shows a **Scheduled Payment Error** notification from `uspgw@uspay.com`, referencing **Customer ID: 0204260**, **Account Num: 4117\*\*\*\*\*\*\*\*4472**, **Amount: $167.00**, and **Merchant: BRONX-HELEN WEINBERG ORTHO GROUP-BRONX**. The radio button selection is set to **"This is NOT spam"**, with **"Train Filter"** and **"Test Filter"** buttons visible.

---
title: "Train spam filter for legitimate payment notification emails being blocked"
category: accounts-and-access
tags: ["spam-filter", "email-whitelist", "spam-training"]
source_thread_id: "spaces/AAAA05BdS6s/threads/GnOD1kOUAuY"
source_space: "spaces/AAAA05BdS6s"
generated_at: "2026-04-22T11:16:45"
participants: ["Tech A", "Tech B", "Tech C"]
---

# Train spam filter for legitimate payment notification emails being blocked

## Problem
Legitimate payment notification emails from uspgw@uspay.com were being flagged as spam by the MD OFFICEMAIL spam filter. The emails contained scheduled payment error notifications and billing confirmations that the office needed to receive. Despite the uspay.com domain already being whitelisted in the address whitelist, the emails continued to be marked as spam with scores ranging from sd=4.5 to sd=9.9.

## Resolution
1. Access the MD OFFICEMAIL ASpam Training interface for the affected account
2. Locate the spam-flagged email and copy the complete raw message including all headers
3. In the ASpam Training interface, select "This is NOT spam" radio button
4. Paste the complete raw email content (headers and body) into the training text field
5. Click "Train Filter" to teach the spam filter that these types of emails are legitimate
6. Verify the training by checking the spam score - legitimate emails should show lower scores after training

Note: Even when domains are whitelisted, individual emails may still require spam filter training if they contain content patterns that trigger high spam scores.

## References
- Source discussion: `spaces/AAAA05BdS6s/threads/GnOD1kOUAuY`
- Attachments:
  - ![image.png](../attachments/GnOD1kOUAuY.FyfoOgceZfs/image.png) — The screenshot shows the **MD OFFICEMAIL ASpam Training interface** for `pdsmgmt@mdofficemail.com`, with a spam score of **sd=4.5** displayed. A raw email header is visible in an overlapping popup window, showing the subject **"Scheduled Payment Error"** from `uspgw@uspay.com`, with the header line **"X-SpamCleaned: Spam manually marked as not spam"** highlighted. The email originated via `mail.bridgepaynetwork.com` (IP **209.208.32.235**) and was received **Thu, 08 Aug 2024 00:04:01 -0500**; the "This is spam" radio button is selected in the training interface.
  - ![image.png](../attachments/GnOD1kOUAuY.MhvqhZ-pQ7w/image.png) — The screen displays an email client's **Spam Control > Address Whitelist** settings page showing "11 out of 58" existing Friends addresses starting at position 48. A text input field for adding addresses is visible, along with a CSV import option and existing whitelisted addresses including domains such as `@darbydentalsupply.com`, `@amazon.com`, `@pdsmgmt.com`, `@gmail.com`, `@uspay.com`, and `@catholicguardian.org`. The address `vsurujbhan@catholicguardian.org` appears highlighted/selected with a red underline indicator visible beneath it.
  - ![image.png](../attachments/GnOD1kOUAuY.RFm7UVFhcHA/image.png) — The screen displays an **ASpam Training interface** for the account `pdsmgmt@mdofficemail.com`, showing a spam filter training page with a spam score readout: `sd=9.9 NoRule 0.04` followed by multiple weighted rule values including `X-SpamContent:isspam (0.90)`, `X-Phrase:isspam (0.90)`, and `X-triplet:trainbad (0.90)`. The message body visible in the text area shows a **Scheduled Payment Error** notification from `uspgw@uspay.com`, referencing **Customer ID: 0204260**, **Account Num: 4117\*\*\*\*\*\*\*\*4472**, **Amount: $167.00**, and **Merchant: BRONX-HELEN WEINBERG ORTHO GROUP-BRONX**. The radio button selection is set to **"This is NOT spam"**, with **"Train Filter"** and **"Test Filter"** buttons visible.
  - ![image.png](../attachments/GnOD1kOUAuY.TxJ-kQ63VAw/image.png) — This image is not relevant to equipment diagnostics or technical maintenance. It shows an email client interface displaying automated billing/payment confirmation emails from a service called "Uspay," with a payment of **$146.00** processed on **8/8/2024**, Reference Number **336793837**, associated with account ending in **3256** for a merchant identified as **BRONX-HELEN WEINBERG ORTHO GROUP-BRONX**.
  - ![image.png](../attachments/GnOD1kOUAuY.hogPtQ5pCJc/image.png) — **MD OFFICEMAIL – ASpam Training Interface (WebMail Port)** The screen displays the **Custom Spam Rule Training** page for account **pdsmgmt@mdofficemail.com**, with two action buttons: **"Test Filter"** and **"Train Filter."** The radio button **"This is spam"** is selected (vs. "This is NOT spam"), and a large empty text input field is present for pasting raw message content with complete headers.
  - ![image.png](../attachments/GnOD1kOUAuY.uComIztLi8g/image.png) — The image shows a webmail interface (Uspay/Mailbox) displaying emails from "Automated Billing Email (do not reply)" originating from uspgw@uspay.com (Sender IP: 209.208.32.235 - 127.0.0.1). The visible email subject references **Ref Num: 336771748**, Customer ID: 0180388, dated 08/07/2024 at 1:03 AM, with the subject line prefixed "Spam:**********" indicating it was flagged by a spam filter. The "Not Spam" button is circled in red, and the email is currently open in the preview pane with spam classification controls visible (Spam, Not Spam, Allow Once, Block Forever).

Generated article

draft