Spam and Junk

Mail from other servers gets a spam score while it arrives: points for what looks like spam (a forged sender, a link to a known bad site, a sender on a blocklist, words and patterns spam uses), and points off for what looks genuine (a valid DKIM signature, a passing DMARC check). Most real mail scores below 2. Obvious spam scores 15 and more.

The score decides where the message goes:

Score	What happens
Below the junk score	The inbox (or wherever your filters put it)
From the junk score	Junk
From the refuse score	Refused: the sender gets an error, and nobody gets the message
A virus, whatever the score	Refused

Spam filtering is something your provider turns on. When it is off, nothing is scored, and the Spam settings below are not shown.

How strict: the presets

There are three starting points:

Preset	Junk from	Refuse from	Good for
Relaxed	8	20	Lots of wanted newsletters and notifications; fewer false alarms
Normal (the default)	6	15	Most people
Strict	4	10	Addresses that get much spam (info@, sales@, published addresses); check Junk more often

Team owners and admins set the team's scores in the domain admin panel, on the Spam card. Start from fills in a preset; Platform's empties both scores so the team follows the provider's. Then Save spam rules.

Each person can choose their own junk score (not the refuse score) in webmail, Settings → Junk and blocking → Spam → How strict: your team's, Relaxed, Normal, Strict, or your own number. A lower number catches more spam but also more real mail.

Start with Normal. After a week or two:

spam still reaching the inbox: move it to Junk, and try Strict;
real mail in Junk: move it out, and allow the sender (below) or try Relaxed.

Teaching the filter

Moving a message into Junk (or Report spam) teaches the filter that mail like it is spam. Moving one out of Junk (Not junk) teaches it that mail like it is wanted. This works from webmail and from any mail app, since the filter watches the Junk folder, not the button. It learns each person's mail separately and gets noticeably better after a few hundred messages each way.

Allowed and blocked senders

In Settings → Junk and blocking → Spam:

Never Junk mail from: addresses (news@shop.example) or whole domains (shop.example). Their mail is never filed in Junk or refused as spam. It is still refused if it has a virus.
Always Junk mail from: their mail always goes to Junk.

Team owners and admins have the same two lists for the whole team, on the Spam card of the domain admin panel. For mail from a domain you never want, see Domain blocking.

Forwarded mail

Mail forwarded to you by another provider can look forged, because it now comes from the forwarder's server. If that provider is one you trust, add it as a trusted forwarder.

Why did this end up in Junk?

Open the message, then More → Source and headers. The X-Spam-Score line is its score, and X-Spam-Status says whether it counted as spam. Authentication-Results shows whether SPF, DKIM and DMARC passed: a failure there is a common reason. A message that was refused never arrived, so there is nothing to look at. Ask the sender to send it again after allowing them, or ask your team's admin: they can see each message's spam score and the rules it hit in the domain admin panel's Message trace, refused messages included.

Filing by score yourself

A mail filter can use the score too, for example to keep likely spam out of the inbox without calling it Junk. i;ascii-numeric compares the whole number before the point, so this matches scores of 3 and up:

require ["fileinto", "relational", "comparator-i;ascii-numeric"];
if allof(not header :matches "x-spam-score" "-*",
         header :value "ge" :comparator "i;ascii-numeric" "x-spam-score" "3") {
  fileinto "Maybe spam";
  stop;
}

The first test matters: to i;ascii-numeric, a value that does not start with a digit (a negative score, the best kind) counts as larger than any number.

Mail filters
Filter recipes: more scripts using the score
SPF, DKIM and DMARC
Webmail