Manage Spam Rules and Senders

This page shows System Admins how to make System Spam Rules, find the senders that need a rule, and read Sender Verification to tell real senders from fakes.

Understand System Spam Rules

  • A Spam Rule marks all mail from a sender as Spam or Not Spam.
  • System Spam Rules apply to every domain and mailbox on this server. Only a System Admin can manage them, on the Rules page.
  • Domain Admins make Domain Spam Rules for their own domain. See Manage a Domain.
  • Users make Spam Rules for their own mailbox on My Rules. They can see the System and Domain Spam Rules that apply to them, but can't change them. See Manage Your Rules.

For Anti-Phishing settings such as the Anti-Phishing model and protected identities, see Protect Against Phishing.

Add a System Spam Rule

  1. In the menu, click Rules.
  2. Click Add Rule.
  3. In Email, Domain, or IP Range, enter the sender.
  4. To cover the domain's subdomains too, check Include subdomains.
  5. Under Action, choose Spam or Not Spam.
  6. Optionally, add a Note that says why the rule exists.
  7. Click Create.

What a Rule Can Match

Enter Example Matches
An email address [email protected] Mail from that one address
A domain example.com Mail from any address at that domain
A wildcard *.example.com or *@example.com Anything that fits the pattern. * stands for any text. *.example.com also covers example.com itself.
An IP address or range 10.0.0.0/24 Mail sent from a server in that range. The range uses CIDR notation, which is an address followed by a slash and the size of the network.

A wildcard must contain at least one letter or number, and the value can be up to 320 characters long.

Change or Remove a Rule

  • Click a rule to edit it. The edit dialog also has a Delete button.
  • Use the switch in the Enabled column to turn a rule off without deleting it.
  • Right-click a rule and choose Delete to remove it.
  • Use the All, Spam, and Not Spam buttons to filter the list.

Know How Rules Work Together

When more than one Spam Rule matches the same message, SpamFoo uses one of them:

  1. A rule made by a System Admin wins over one made by a Domain Admin, which wins over one made by a User.
  2. Among rules made by the same role, Not Spam wins over Spam.
  3. If there is still a tie, the more exact rule wins: an email address, then a domain, then a wildcard, then an IP range.

When the chosen rule is a Domain Spam Rule or a mailbox rule, it decides the result before any other check runs. A System Spam Rule works a little differently:

  • SpamFoo runs its other checks first and applies the System Spam Rule at the end.
  • This lets a user's own choices win for their mailbox. A Not Spam System Spam Rule gives way when the user's past corrections for that sender decided the message. A Spam System Spam Rule always applies.
  • In every other case, the System Spam Rule decides the result, including over phishing checks.

See How SpamFoo Classifies Email and How Personalization Works.

Create Rules From Messages and Senders

You don't have to type every rule by hand. A rule made from these pages is a System Spam Rule.

  • Messages: right-click a message and choose Create rule for the sender, or Create rule for IP for the server it came from. You can also click Create Rule in a message's details.
  • Senders: right-click a sender and choose Create rule, or click Create Rule in the sender's details.

Review Senders

The Senders page shows who is sending mail to this server. Use it to find senders that send a lot of spam, or senders that need a Not Spam rule.

  • Switch between Domains, IP Addresses, and Email Addresses.
  • Pick a time range at the top right, from the last hour to the last 30 days.
  • Each row shows how many messages were scanned, how many were spam and phishing, the caught rate (the share that was spam or phishing), and when the sender was last seen.
  • The list starts with the most spam at the top. Click a column heading to sort another way.
  • Right-click a row for Open details, View messages, Create rule, and Copy value.

Click a row to open its details. You see totals, when the sender was first and last seen, a daily activity chart, and the sender's recent messages. Daily activity is only kept for domains and IP addresses, not single email addresses.

The Senders page is about mail coming in from outside. To see the domains hosted on your server, use Overview > Domains.

Check Sender Verification

Sender Verification tells you whether a message really came from the domain in its From address. SpamFoo works it out from three standard email checks:

  • SPF: whether the sending server is allowed to send for the domain.
  • DKIM: whether the message carries a valid digital signature from the domain.
  • DMARC: the domain's own policy that ties SPF and DKIM to the From address.

Each message gets one of four states:

State What It Means
Verified DMARC passed, or the domain has no DMARC policy and SPF or DKIM passed.
Spoofed DMARC failed, or SPF failed and DKIM did not pass. The message may not be from the domain it claims.
Blocked SpamFoo's global reputation data marks the sender's domain as untrusted because of high spam volume.
Unknown Nothing proved the sender real or fake. This includes messages that a rule, a learned preference, or a cached result decided before authentication was checked.

Where to find it:

  • The Verified column on the Messages page shows the state for each message.
  • The Verified filter narrows the list to one state. For example, filter on Spoofed to look for forged mail that got through.
  • The Sender Verification card in a message's details explains the state and the reason for it.
Tip Before you add a Not Spam rule for a domain, check that its messages are Verified. A rule for a domain that is often Spoofed also lets forged mail through.