Domain Spam Filtering

This settings page is only available to domain administrators and system administrators with the proper permissions.

SmarterMail includes a variety of antispam measures that will help keep a user's inbox free of unwanted mail. When a message arrives, each enabled spam check — RBLs, URIBLs, SPF, DKIM, DMARC, Bayesian/SpamAssassin or Rspamd scoring, and others — contributes its own weight, and those weights are simply added together into a single running total (there is no cap or multiplier applied to the sum). That total weight then places the message in a Low, Medium, or High probability category — each of which has an Action associated with it. In the Spam Filtering section, domain administrators can review/configure those Actions and manage trusted senders for users on their domain.

Note: The individual weight assigned to each spam check (for example, how many points an SPF failure or an RBL hit contributes) is configured exclusively by the system administrator. Domain administrators cannot enable/disable individual spam checks or change their per-check weights — the only things a domain administrator can override here are the Actions associated with the Low/Medium/High weight thresholds and the domain's Trusted Senders list.

Jump To:

Options - Configure the filtering Actions for spam messages on your domain
Trusted Senders - Exempt specific email addresses and domains from spam filtering

Options

In most cases, a system administrator has already configured the filtering options — spam weights and Actions — for spam messages on your domain. However, if the system administrator allows it, domain administrators can override those settings and change the Actions configured for spam messages of varying weights to help further remove potentially unwanted email. The Options card contains the following toggles:

Override spam settings - Enable this setting to customize the spam filtering Actions for your domain. If this option is disabled, the probability cards display the system's default spam filtering policy — greyed out, with a "Source: System Policy" watermark — and can't be edited.
Allow users to override spam settings - Enable this setting if, as the domain administrator, you want to allow users to be able to further edit and manage the Actions taken on messages of varying weights. When enabled, each user gets their own Spam Filtering settings page; when disabled, your domain policy applies to everyone.

Note: If the system administrator has not allowed domain overrides, these toggles are hidden entirely, and the page can only be used to manage Trusted Senders.

SmarterMail resolves which set of Actions actually applies to a message using a strict three-level hierarchy, checked from the most specific to the least specific: user-level settings are used first (if the domain allows user overrides and the user has enabled their own override); otherwise domain-level settings are used (if the system administrator allows domain overrides and this domain has enabled Override spam settings); and if neither override is active, the system-wide policy applies. This is why a setting on this page can appear "locked" or read-only — it means a higher-level toggle further up the chain hasn't granted permission to override it yet.

Editing Actions

The Options card displays a card for each spam probability level — Low Probability of Being Spam, Medium Probability of Being Spam, and High Probability of Being Spam — each showing its current Action and the weight threshold at which a message falls into that level. (The weights themselves are configured by the system administrator.)

To edit an Action, first enable Override spam settings, then click on the card associated with the probability level you want to edit. Select the new Action from the dropdown and click the OK button, then save the page. The available Actions are:

No Action - The message is delivered normally.
Delete Message - The message is deleted outright and never reaches the user. Use this with care, as false positives are unrecoverable; it's most appropriate for the High probability level.
Move to Junk Email Folder - The message is delivered to the user's Junk Email folder, where it can still be reviewed and rescued if it was misclassified.
Add Text to Subject - The message is delivered normally, but with text you specify prepended to the subject line. For example, tagging Low probability messages with "[Possible Spam]" lets users (or their filters) handle them as they see fit.

A common configuration is exactly that graduated approach: Add Text to Subject for Low, Move to Junk Email Folder for Medium, and Delete Message for High.

Trusted Senders

Domain administrators can add specific email addresses (such as jsmith@example.com) or domains (such as example.com) that will be exempted from most spam filtering. This lets the system know that these messages come from a trusted source and can prevent mail from friends, business associates, and mailing lists from being blocked or sent to the Junk Email folder. The Trusted Senders card contains two lists — Trusted Domains and Trusted Email Addresses — each showing a count of its entries. Click either one to edit it; entries are entered one item per line, and any invalid lines are flagged for correction before you can save. Entries here apply to every user on the domain, so it's a good place for business partners and services the whole organization relies on.

Note: Email addresses in a user's Contacts are always considered trusted senders automatically.

Spam Filtering and Trusted Senders

We say that Trusted Senders bypass "most" spam filtering, because while they do bypass things like RBL and URIBL checks, other checks are ALWAYS run (when enabled) on ALL messages, regardless of whether the sender is considered "trusted".

If the system administrator has enabled SPF, DKIM, and/or DMARC (all of which are strongly recommended), SmarterMail will run those checks on ALL emails, including those from trusted senders, whitelisted IP addresses, and IP bypasses. This "trust but verify" approach is important because anyone can write any return path that they want when sending a message. Therefore, this extra layer of protection helps prevent spammers from flooding users with hundreds of messages that aren't truly from a trusted sender. If an SPF, DKIM, or DMARC check fails on an incoming message, the "trusted sender" is no longer trusted by SmarterMail, and the weights of all enabled spam checks will be applied to that message.

DMARC, specifically, plays an integral part in determining "trusted" status. DMARC is the only check available that can confirm that the From address listed in the email is associated to the SPF record and return path. DMARC, therefore, ensures that the From address wasn't spoofed and the sender automatically trusted just because the From address is listed as a trusted sender. It is an extra step of security to ensure that senders are only 'whitelisted' if SmarterMail can verify the sender.

The specific spam check results that will bypass the trusted sender status are SPF_Fail, SPF_Softfail, SPF_PermError, or DKIM_Fail.

Note: Other SPF outcomes — such as Neutral, None, or Temp Error — do not revoke trusted sender status. Only the specific failure results listed above are treated as strong enough evidence of spoofing to override an otherwise-trusted sender.

It's also worth understanding how a DMARC failure is actually enforced. If the sending domain's DMARC record specifies a policy of quarantine, a failing message is allowed through to the spam weighting system, where it receives an additional weight penalty for the failure — meaning it's evaluated like any other message and could still land in the Inbox if its overall weight stays below the Low probability threshold. If the DMARC record instead specifies a policy of reject, SmarterMail rejects the message outright at the SMTP level; it never reaches the spam weighting system (and therefore never reaches a mailbox) at all.

If the trusted sender status of an email was bypassed due to a failed SPF or DKIM check, the TotalSpamWeight line in the email header would appear in the following format:

X-SmarterMail-TotalSpamWeight: {Total Spam Weight} ({Where the trusted sender status originates}, {Reason the trusted sender status was bypassed})

For example:

X-SmarterMail-TotalSpamWeight: 9 (Trusted Sender - Domain, failed SPF)

This example indicates that the sender is in the domain-level Trusted Senders list, but the email received a total spam weight of 9 because the message failed the SPF check.

Regarding DMARC

We evaluate the DMARC results of an incoming email in order to determine whether the From Address or Return Path will be used for the Trusted Sender verification. If DMARC has a passing result, SmarterMail will use the From Address to determine if the email is in the Trusted Senders list. In most cases, the Return Path and From Address of an email are the same, and users will likely have the sender's From Address in their Trusted Senders list. In these cases, as long as SPF and DKIM don't fail or error, the email should be delivered to the user's Inbox without a spam weight applied. If DMARC doesn't have a passing result, SmarterMail will use the Return Path to determine if the email is from a Trusted Sender. If the Return Path address is in the Trusted Senders list as well, the email should be delivered to the user's Inbox without a spam weight applied. If the Return Path address isn't in the user's Trusted Senders list, the full spam weight of the message will be applied, and the email will be filtered / moved according to the user's spam filtering settings. In these situations, the message will likely land in the Junk Email folder, and the X-SmarterMail-TotalSpamWeight header will show why the weight was applied, with something like this:

X-SmarterMail-TotalSpamWeight: 37 (Trusted Sender - User, DMARC: None)

X-SmarterMail-TotalSpamWeight: 24 (Trusted Sender - User, DMARC: Skipped - DMARC Disabled)

These are the DMARC results that are considered "passing" and will allow the From Address to be considered in the Trusted Sender verification process:

DMARC: [passed]
DMARC: [skipped - Authenticated]
This will appear if the sender is an authenticated domain user or if the sender's IP address is in the whitelist with an SMTP Auth Bypass.
DMARC: [skipped - Bypassed]
This will appear if the sender's IP address is in the IP Bypass with Bypass Spam Checks enabled, and there is only 1 Received line in the email header/delivery.
DMARC: [skipped - Whitelisted]
This will appear if the sender's IP address is in the Whitelist with an SMTP Spam Bypass.

These are the DMARC results that are not considered "passing", and will disallow the From Address from being considered in the Trusted Sender verification process.

DMARC: [none]
DMARC: [failed]
DMARC: [skipped - DMARC Disabled]
DMARC: [skipped - No Return Path]

This logic also applies when adding or removing Trusted Senders from within the Email section (e.g., using Trust Sender on a message):

If the Return Path and From Address match, then the From Address is added/removed.
If the Return Path and From Address differ, the DMARC results of that email are examined.

If DMARC passed (or was skipped due to authentication, bypass or whitelist), the From Address is added/removed.
If DMARC didn't pass, BOTH the From Address and the Return Path address are added/removed. (This is done to help ensure that the sender will pass the DMARC Trusted Sender verification process on subsequent messages.)