How the spam filter works

Every message to your domain passes through a 7-layer pipeline before clean mail is relayed to your server. Each layer contributes a score; the combined score decides the verdict.

The layers

• L0 — Connection: sending IP reputation, reverse-DNS and HELO checks, adaptive greylisting.
• L1 — Identity: SPF, DKIM and DMARC authentication results, TLS checks.
• L2 — Envelope: sender address, look-alike and homoglyph domains, domain age, geography.
• L3 — Content: MIME structure, attachments, links, macros, formatting, spam phrases.
• L4 — Threat intelligence: URL and attachment-hash reputation, plus ClamAV virus scanning.
• L5 — Behavioural: sending patterns, sender profiling and a trainable Bayesian model.
• L6 — Rules: your own allow/block lists and rules.
• AI layer (optional): an LLM reads the message for spam/phishing cues.

Additional checks feed into those layers: header anomalies (Received chain, Reply-To mismatch), image OCR for text hidden in pictures, a QR-code scanner for phishing links inside QR images, thread analysis (is this really a reply?), recipient risk, and impersonation/BEC detection — see Impersonation protection.

Verdicts

The combined score maps to one of:

• Accept — delivered to your inbox.
• Quarantine — held for review (you can release it).
• Reject — refused outright (near-certain spam).

Where those lines fall is controlled by your domain's spam sensitivity (Relaxed / Balanced / Strict) — see that article. A few signals, such as a confirmed impersonation attempt, force quarantine on their own.

Explainability

Every verdict records the per-layer scores and the reasons, so when you open a quarantined message you can see exactly why it was held.

It learns

The Bayesian layer learns from feedback — when you release or block messages, the engine adapts to your mail over time.