Mail identified as possible junk email by Office 365 is automatically moved to the Junk email folder, and any potentially dangerous content within the message, e.g. links or executable code, is disabled.
Types of unwanted email
Junk Email
Junk email, also known as spam, is unsolicited, and usually commercial in nature. It can fill mailboxes with unwanted and potentially offensives messages and images. Most of it is annoying, but harmless. Most junk email is blocked before it reaches its destination.
Phishing
Phishing is a specific type of junk email that's also an attack against the recipient, usually to steal information or conduct identity theft. The email message appears to come from a legitimate source, such as a colleague, and often includes a logo and a reply address that looks real at first glance.
Graymail
Graymail is email you opted in to receive, but don't really want. If you used your Drake email address to purchase an item online or sign up for a newsletter, the subsequent messages you receive are graymail. Organizations often sell their recipient lists, compounding the problem.
These messages are required by law to allow you to unsubscribe, which can usually be done through a link in the email, or by responding directly to the sender.
Backscatter
Backscatter is the technical term for bounce back messages generated when an attacker uses your email address in the From field of their messages. This does not mean they have access to your account, but if you feel that your account may be at risk, change your password. If the attacker's message cannot be delivered to the recipient, a bounce or non-delivery report will be sent to the address in the From field. Backscatter takes a few forms:
- Delivery Status Notifications advising that the message cannot be delivered, or is delayed.
- Auto-replies advising that the mailbox is no longer in use or that the recipient is out.
- Challenge messages requesting that you confirm that you sent the message.
If an attacker sends a large number of messages this way, you may receive hundreds of backscatter messages without warning.
Spoofing
When an attacker puts your email address in the From field, but they are not actually accessing your account, this is called spoofing. They're using the address to appear that you sent the message, though the underlying technical components of the message display its true origin.
It is generally not possible to stop backscatter or spoofing from occurring. Attackers usually switch addresses frequently to keep spam filters from blocking their messages.
How do messages get identified as junk email/spam?
When a message destined for a Drake.edu email account is received in Office 365, it is scanned by systems that are looking for specific characteristics, and is tagged with a spam rating between 1 and 7. If a message is tagged with a rating of 6 or higher, it is moved into the Junk Email folder.
What can I do with misidentified messages in the Junk Email or Inbox folders?
When you receive messages that have been wrongly categorized, whether they should be labeled as Junk Email and bypass your inbox, or are legitimate and wind up in the Junk email folder, you can quickly train the system on how these messages should be treated by blocking and allowing senders. See Microsoft's instructions on how to Block or allow (junk email settings).
How can I avoid getting spam and/or graymail?
The only way to avoid receiving spam is to make sure that spammers do not know your email address, or make them think that your account is not being read. There are several methods to help limit the amount of spam you receive.
- If the organization is reputable, unsubscribe from the mailing list. You should be able to determine this from the message or the sender's website. Additionally, when you do create web accounts, look carefully for a check box related to newsletter or marketing messages.
- If the organization is not reputable, don't reply or interact with the message, simply mark it as junk then delete it and move on. This will cause the email to go to your junk folder in Outlook and it allows you to safely delete it.
- Use a personal email address for e-commerce. Using a free account from an organization like Gmail for non Drake-related communications or transactions will allow for easier distinction.
- Avoid publishing your Drake email address on any web pages. Attackers and spammers use tools to continuously scan for email addresses on our web pages.