General: How our mailfilter works Print

(Note: This information does not apply if the additional service SpamExperts is active for your domain.)

Each e-mail delievered to us first passes through a filter. The outcome of this filtering determines what happens to the e-mail that is being delivered. The different outcomes are described below:

1. Sender is not allowed to deliver e-mail to us

This will happen e.g. if the sender's e-mail server is blacklisted, or has a behaviour that breaks with current standards. This blocks a significant amount of spam, and very rarely affects legitimate e-mail. If it does block legitimate e-mail, the sender will normally get a bounce mail with an error message. For the mail to be delivered successfully, the sender must resolve the issues on their side.

2. The e-mail is blocked/deleted

This will happen if we detect e.g. a virus, or an illegal attachment (.exe, .cmd, .com, etc). These will normally not generate any kind of error/bounce message to sender or recipient, because these types of e-mail almost always is sent from fake addresses.

3. The e-mail is delivered to the Junk folder, and tagged as spam

This happens if our filter gives the e-mail a total score of 5 or higher (see "About score" below). In some cases, legitimate e-mail will end up here, if the sender has some errors in their setup, or the e-mail has content that is typical for spam. It is a good idea to check the contents of the Junk folder from time to time, or if you're missing an e-mail.

The filter rule that moves spam to the Junk folder is created automatically by us, but it can be changed or removed after logging into our Webmail. Se this article for more information about filtering: Webmail: Create filters for incoming email.

The tagging is done in two ways. One is that the text [SPAM] is added to the beginning of the Subject: field. This makes it easy to see if we consider an e-mail to be spam, even if you don't have the rule that places it into the Junk folder:

Subject: [SPAM] This is a spammy test mail

In addition, mail headers[1] are added that shows information from our filter. For an e-mail that is considered spam, the headers might look something like this:

X-Spam-Flag: YES
X-Spam-Score: 5.3
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.3 tagged_above=-999 required=5
        tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
        DKIM_VALID_EF=-0.1, KAM_NUMSUBJECT=0.5, NKN_SCORE_5=5,
        SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no

4. The e-mail is delivered to your Inbox, without being tagged as spam

This happens when our filter gives the e-mail a total score below 5. Sometimes the filter will let through spam mail without being tagged as spam. Be aware of suspicious e-mails, and don't click on links or attachments you don't recognize. An e-mail like this will also have mail headers[1] added by our filter, but they will look slightly different, example:

X-Spam-Flag: NO
X-Spam-Score: 0.3
X-Spam-Level:
X-Spam-Status: No, score=0.3 tagged_above=-999 required=5
        tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
        DKIM_VALID_EF=-0.1, KAM_NUMSUBJECT=0.5, SPF_HELO_NONE=0.001,
        SPF_PASS=-0.001] autolearn=no autolearn_force=no

About score

All e-mail delivered to you will get a total score that determines whether or not we consider an e-mail spammy. Our filter does a series of tests that affects the final score. The total score required currently to be considered spam is 5, and can be seen in the header X-Spam-Status, with the text required=5. We may adjust this globally if we need to, in order to improve the efficiency of the filter.

Notes

[1] Mail headers in an e-mail can be compared to the envelope on a letter. Some are visible in a typical e-mail program, like sender (From:), recipient (To:), subject (Subject:) and date (Date:). Most of the headers are hidden by your e-mail program, and they contain a lot of information about the travels of an email, and what has happened along the way.