How does the spam filter for incoming and outgoing emails work?

Spam Control checks incoming and outgoing emails of your domain for spam, viruses, phishing, and other harmful content. The spam filter works in multiple stages and evaluates emails based on various checks to ensure that legitimate messages are delivered as reliably as possible and harmful messages are detected.

Table of Contents

• How does Spam Control work?
• Which verification methods are used?
• What is the reputation score?
• Filtering at the SMTP level
• Filtering at the DATA level
• What happens with rejected emails?

How does Spam Control work?

Spam Control is based on a redundant and multi-stage filter architecture. Each email is processed by several verification and security systems before it is delivered, rejected, or moved to quarantine.

Not only individual features are checked. Spam Control combines several filtering methods to reduce false alarms and evaluate emails as reliably as possible.

Basically, two technical filter levels are distinguished:

• Filtering at the SMTP level: Check during connection acceptance.
• Filtering at the DATA level: Checking the content and attachments.

Which verification methods are used?

Spam Control uses several verification methods to evaluate incoming and outgoing emails.

• Filter lists: Emails are matched against known spam characteristics, blacklists, and whitelists. This includes, for example, senders, IP addresses, or certain technical features.
• IP verification: The IP address of the sending server is checked. This can detect whether the server has previously been flagged for spam or abusive sending.
• Content filter: Content, subject, and other components of the email are checked for typical spam patterns.
• Malware and phishing check: Emails and attachments are checked for viruses, phishing, and other harmful content.

What is the reputation score?

A rating for the email is formed from the individual checks. This rating is often referred to as the reputation score or spam score.

If the overall rating exceeds a set threshold, the email is classified as spam. Depending on the rating and settings, the message is delivered, moved to quarantine, or rejected.

Filtering at the SMTP level

At the SMTP level, the email is already checked during the connection between the sending mail server and Spam Control. Technical features such as sender server, IP address, recipient, and the behavior of the sending server are evaluated.

If a connection originates from an unknown source, it can be temporarily rejected with a 4xx error code. The sending mail server usually places the message in its own queue and attempts delivery again later.

This procedure is similar to greylisting. Spam Control uses a synchronized filter logic so that legitimate mail servers are accepted more quickly after successful verification in the future.

If the connection clearly originates from a known spam source or violates technical email standards, the message can be permanently rejected with a 5xx error code.

Filtering at the DATA level

At the DATA level, the content of the email is checked. This includes, among other things, the message text, subject, attachments, and technical features of the message.

Spam Control uses various filtering technologies for this, including:

• Spam fingerprint databases
• Virus databases
• Phishing and spyware databases
• Statistical filtering methods
• Rules for conspicuous content and technical features

If an email is detected as spam at this level, further handling depends on the rating and the configured protection and quarantine options.

What happens with rejected emails?

If an email is temporarily rejected, the sending mail server receives a 4xx error code. Delivery is usually automatically retried.

If an email is permanently rejected, the sending mail server receives a 5xx error code. In this case, the sender should receive a non-delivery notification from their mail server.

Emails detected as spam can, depending on the settings, be available in quarantine for review. Emails with viruses or clearly harmful content may be handled differently for security reasons and are not always available for release.