Spam filter

Two mechanisms decide whether an incoming message is spam:

• Spam scoring examines each message on its own.
• The allow and deny lists overrule that decision for senders you've already decided about.

note

Sorting accepted mail into folders is a separate job. See Sieve filtering.

The spam score and the threshold

Each incoming message gets a spam score based on its content, the sender's reputation, and the authentication results.

Score	What happens
At or above the Spam Score Threshold	The message is marked as spam and goes to the mailbox's Junk folder instead of the inbox.
Far above the threshold	The server refuses the message.

The threshold defaults to 6. You set it in two places:

• as the default for the whole mail service
• as an override for one mailbox, under the domain user's Email Access Policy section. An empty field means "use the service's default".

A lower value catches more spam, and marks more good mail as spam.

Change one mailbox first

One address that gets a lot of spam is no reason to make the whole domain stricter.

A forwarder behaves differently, by design

A forwarder refuses suspected spam instead of forwarding it. Forwarding spam to an external destination would damage your domain's reputation there.

For comparison, mail to a group goes to each member's Junk folder as usual, and a mailing list verifies a post before distributing it.

Allow/Deny Lists

The Allow/Deny Lists page holds the sender rules for your whole account: "never mark mail from our payment processor as spam", or "refuse everything from this domain".

Each entry names two things:

• a Sender: a full address such as [email protected], a domain such as example.com, or a subdomain wildcard such as .example.com, which matches the domain and everything below it
• a Decision: Allow or Deny

When several entries match a message, the most specific wins: a full address over a domain, a domain over a subdomain wildcard. The rules apply to your whole account, before each mailbox's own filtering.

An entry can also carry Allowed Origins: the networks or hostnames the sender's mail must come from. Mail from anywhere else doesn't get the Allow decision.

Normally, leave Allowed Origins empty

The sender's SPF, DKIM, and DMARC records already prove the origin.

The field is for the unusual sender whose mail is legitimate but fails authentication, e.g. a misconfigured appliance or an old relay. Pinning the origin lets you allow that sender without also allowing anyone who forges the address.

Spam learning

The filter also learns from how people handle mail.

Client	How to teach it
Webmail	The Mark as spam and Not spam actions.
A normal email client	Move the message into the Junk or Spam folder to mark it as spam, or out of that folder back to the inbox to mark it as not spam.

Teaching is the first answer to a sender in the wrong folder

Learning moves the score slowly, over time. An allow or deny entry is an immediate overrule. The two work well together.