Email, Spam Control, Still receiving email from someone on Block List

Problem: I put someone on my Personal Block List, but I'm still receiving email from them.

There are a few issues to consider when blocking unwanted email senders

1)  The Campus offers two lines of defense from unwanted email senders. Spam Control, represents the spam filtering and protection at the network border via the Campus Email Relays. Proofpoint, is the software we run on the Email Relays. Exchange, is one of the many email servers/services sitting behind the Campus Email Relays. 
You can block specific email addresses, or whole domains at the border via Spam Control. More information can be found here: Spam Settings
You can access your Spam Settings using the web interface.


2)  Spoofed email: (Situation):
The name and address from which an email message appears is often not the 'actual sender.' If you look at the 'full headers' of the email message (see: How do I view mail headers?), you can find the 'actual email address' of the sender listed in the 'X-Spam-OrigSender' field.  

For example, the email message details might show:
  • From: team@usa.com, but the 'X-Spam-OrigSender' lists the mail address as: bounce-sns01-378895@cooldude.usa.com
  • So if you added team@usa.com to your Block List, an email from @cooldude.usa.com could still make it through.  
    • If this domain is constantly sending spam, you can block all email from the domain by adding it to your block list: (e.g. cooldude.usa.com). 

3)  Spammers constantly change the true address on messages to circumvent block lists.  While the Proofpoint Spam Control filters are updated daily, it's not 100% effective because of the dynamic nature of spam. One way you can help update the spam signatures to identify new spam campaigns is to forward the offending email to report-spam@illinois.edu.  Email sent to this address is automatically submitted to Proofpoint for spam evaluation and if the email is determined to be spam, they will generate a new spam signature and update our email relays.  


See Also: