Source: https://help.spamfoo.com/guides/rules-protection
Last updated: 2026-10-20

***

# Manage Spam Rules and Senders

This page shows System Admins how to make System Spam Rules, find the senders that need a rule, and read Sender Verification to tell real senders from fakes.

## Understand System Spam Rules

- A Spam Rule marks all mail from a sender as **Spam** or **Not Spam**.
- System Spam Rules apply to every domain and mailbox on this server. Only a System Admin can manage them, on the **Rules** page.
- Domain Admins make Domain Spam Rules for their own domain. See [Manage a Domain](https://help.spamfoo.com/guides/manage-domain).
- Users make Spam Rules for their own mailbox on **My Rules**. They can see the System and Domain Spam Rules that apply to them, but can't change them. See [Manage Your Rules](https://help.spamfoo.com/guides/my-rules).

For Anti-Phishing settings such as the Anti-Phishing model and protected identities, see [Protect Against Phishing](https://help.spamfoo.com/guides/phishing-protection).

## Add a System Spam Rule

1. In the menu, click **Rules**.
2. Click **Add Rule**.
3. In **Email, Domain, or IP Range**, enter the sender.
4. To cover the domain's subdomains too, check **Include subdomains**.
5. Under **Action**, choose **Spam** or **Not Spam**.
6. Optionally, add a **Note** that says why the rule exists.
7. Click **Create**.

### What a Rule Can Match

| Enter | Example | Matches |
| --- | --- | --- |
| An email address | `news@example.com` | Mail from that one address |
| A domain | `example.com` | Mail from any address at that domain |
| A wildcard | `*.example.com` or `*@example.com` | Anything that fits the pattern. `*` stands for any text. `*.example.com` also covers `example.com` itself. |
| An IP address or range | `10.0.0.0/24` | Mail sent from a server in that range. The range uses CIDR notation, which is an address followed by a slash and the size of the network. |

A wildcard must contain at least one letter or number, and the value can be up to 320 characters long.

### Change or Remove a Rule

- Click a rule to edit it. The edit dialog also has a **Delete** button.
- Use the switch in the **Enabled** column to turn a rule off without deleting it.
- Right-click a rule and choose **Delete** to remove it.
- Use the **All**, **Spam**, and **Not Spam** buttons to filter the list.

## Know How Rules Work Together

When more than one Spam Rule matches the same message, SpamFoo uses one of them:

1. A rule made by a System Admin wins over one made by a Domain Admin, which wins over one made by a User.
2. Among rules made by the same role, **Not Spam** wins over **Spam**.
3. If there is still a tie, the more exact rule wins: an email address, then a domain, then a wildcard, then an IP range.

When the chosen rule is a Domain Spam Rule or a mailbox rule, it decides the result before any other check runs. A System Spam Rule works a little differently:

- SpamFoo runs its other checks first and applies the System Spam Rule at the end.
- This lets a user's own choices win for their mailbox. A **Not Spam** System Spam Rule gives way when the user's past corrections for that sender decided the message. A **Spam** System Spam Rule always applies.
- In every other case, the System Spam Rule decides the result, including over phishing checks.

See [How SpamFoo Classifies Email](https://help.spamfoo.com/guides/how-classification-works) and [How Personalization Works](https://help.spamfoo.com/guides/personalization).

## Create Rules From Messages and Senders

You don't have to type every rule by hand. A rule made from these pages is a System Spam Rule.

- **Messages:** right-click a message and choose **Create rule** for the sender, or **Create rule for IP** for the server it came from. You can also click **Create Rule** in a message's details.
- **Senders:** right-click a sender and choose **Create rule**, or click **Create Rule** in the sender's details.

## Review Senders

The **Senders** page shows who is sending mail to this server. Use it to find senders that send a lot of spam, or senders that need a Not Spam rule.

- Switch between **Domains**, **IP Addresses**, and **Email Addresses**.
- Pick a time range at the top right, from the last hour to the last 30 days.
- Each row shows how many messages were scanned, how many were spam and phishing, the caught rate (the share that was spam or phishing), and when the sender was last seen.
- The list starts with the most spam at the top. Click a column heading to sort another way.
- Right-click a row for **Open details**, **View messages**, **Create rule**, and **Copy value**.

Click a row to open its details. You see totals, when the sender was first and last seen, a daily activity chart, and the sender's recent messages. Daily activity is only kept for domains and IP addresses, not single email addresses.

The Senders page is about mail coming in from outside. To see the domains hosted on your server, use **Overview > Domains**.

## Check Sender Verification

Sender Verification tells you whether a message really came from the domain in its From address. SpamFoo works it out from three standard email checks:

- **SPF:** whether the sending server is allowed to send for the domain.
- **DKIM:** whether the message carries a valid digital signature from the domain.
- **DMARC:** the domain's own policy that ties SPF and DKIM to the From address.

Each message gets one of four states:

| State | What It Means |
| --- | --- |
| **Verified** | DMARC passed, or the domain has no DMARC policy and SPF or DKIM passed. |
| **Spoofed** | DMARC failed, or SPF failed and DKIM did not pass. The message may not be from the domain it claims. |
| **Blocked** | SpamFoo's global reputation data marks the sender's domain as untrusted because of high spam volume. |
| **Unknown** | Nothing proved the sender real or fake. This includes messages that a rule, a learned preference, or a cached result decided before authentication was checked. |

Where to find it:

- The **Verified** column on the Messages page shows the state for each message.
- The **Verified** filter narrows the list to one state. For example, filter on **Spoofed** to look for forged mail that got through.
- The **Sender Verification** card in a message's details explains the state and the reason for it.

> **Tip** Before you add a Not Spam rule for a domain, check that its messages are Verified. A rule for a domain that is often Spoofed also lets forged mail through.