Spam is any unwanted bulk email - it can be an advertisement, an attempt to spread a virus or an attempt to gain access to your personal information.  It can even be email from a legitimate site as a result of someone spoofing your email address.   For more details, please see the UBC ITService Catelogue  Spam and Email Harrasment  and  Dealing With Phishing web pages. 

PHAS Mail Server

Mail addressed to any of our mail domains is first directed to the UBC Mail Relays for spam and virus detection. The mail relays run PureMessage, a spam filtering/virus detecting product from Sophos. The sanitized messages are sent to our incoming mail server,, for storage on disk & delivery to the users' inboxes. 

The PHAS server uses the dovecot "deliver" program as the LDA (Local Delivery Agent). This means that any user-defined sieve filters will be applied before the delivery to the inbox.  Default sieve filters are in place for most user accounts which will file messages tagged with a spam score of 30% or more in a folder called SPAM_PMX.   (If you don't see this folder in your mail client, you may need to "subscribe" to it first.)  You can customize the sieve filters - see the local sieve page for details.

Mail Client Filtering

Most mail clients include tools for filtering your incoming messages.  The filtering system can be "taught" to detect junk email - for example, Mozilla Thunderbird's junk mail tool.   See also ITServices Client-Side Spam Filtering web page.

You can often unsubscribe from unwanted email lists  - just use your common sense when following the unsubscribe instructions.

How to forward email spam and false-positive spam samples to SophosLabs

It is preferred that you send samples as RFC-2822 attachments. Submitting in any other format can cause the loss of key message content, which may prevent SophosLabs from effectively analyzing the samples.

Email spam samples to :

Email false-positive spam samples to

NOTE:  Be sure to strip out any and all personally identifiable information (PII) from the email before forwarding it to SophosLabs!

PII is defined by the University Counsel as “recorded information about an identifiable individual other than contact information.” 
Contact information refers to the business telephone number, address, and/or email of all UBC employees, faculty members, volunteers, and service providers, but not of its students. Further details on what is considered PII can be found in the Privacy Fact Sheet

What to do

From Microsoft Outlook

  1. Create a new email message.
  2. Address it to one of the above Sophos addresses.
  3. From your Inbox, select the spam email that you received - you must select the email, not the content.
  4. Drag and drop the selected item(s) into the new email.
  5. This will now show as an empty email with the suspect email as an attachment.
  6. Send the email to Sophos at the address you selected above.

From Mozilla Thunderbird

  1. Select the sample.
  2. From the toolbar choose Message > Forward > Attachment.
  3. Address it to one of the above Sophos addresses.
  4. Send the email.

From Lotus Notes

Sophos cannot recommend a default method for attaching RFC-2822 messages, but the following options are available:

  • Send the message direct to your Sophos Technical Support contact:
    • create a new email message addressed to your support contact
    • open the spam message, select View > Show > Page Source
    • copy and paste the Page Source content into the new email
  • Use the free third party enhancement software, 'Open-NTF'. This adds a menu option, 'Forward MIME to RFC-2822', to the Tools button. Use this to forward the email.

From other email clients

With other email client use the option 'Forward As Attachment'. You should discuss this with Sophos Technical Support before sending in a sample in this way.

Further information

Spam samples sent to one of the above Sophos addresses as RFC-2822 attachments will be automatically processed by systems within SophosLabs.

  • You will not receive feedback for emails messages sent to these addresses.
  • Samples sent to these addresses will not necessarily be considered to be, or detected as, spam.

If you believe that an item should be detected, raise the matter with Sophos Technical Support.

If you wish to submit spam samples to support, attach the entire message source.