Insights on email security, spam filtering strategies, and the real cost of unprotected inboxes.
Treating every non-spam message as equally important — or every borderline message as spam — was always a compromise. Spam Killer's new five-way classification distinguishes ham, social, promotional, spam-promotional, and spam, so each kind of mail can land where it belongs. Here's how it works and why it changes the inbox math.
The promotional classifier combines authentication checks (SPF, DKIM, valid MX) with bulk-mail indicators (List-Unsubscribe, Precedence, marketing sender patterns) to identify legitimate marketing mail with high precision.
Social platform mail is bulk, repetitive, and template-driven — exactly the things Bayesian classifiers learn to flag. Spam Killer takes a different approach: domain match plus full authentication, no fuzzy scoring required.
What do you do with a promotional email that scores like spam? Spam Killer's new spam_tag option preserves both verdicts — your client can route based on the [SPAM] prefix or the X-Spam-Classification: spam-promotional header.
Legitimate senders almost always have valid MX records — they need to receive bounces and replies. Spammers often don't. Here's how Spam Killer turns that asymmetry into a high-precision classification signal.
The X-Spam-Classification header takes one of five values: ham, social, promotional, spam-promotional, or spam. Here's how to route on it in Outlook, Gmail, Postfix, and Sieve — with the exact rules that work.
"Inbox zero" failed for most people because the inbox was the wrong unit of organization. With five-way classification at the proxy, the inbox can finally hold only the mail that actually requires attention.
The forward error log is a separate JSONL stream that captures every message Spam Killer accepted but couldn't deliver upstream. Here's what it records, how to query it, and how to alert on patterns that matter.
Aggregating spam stats across all the domains a proxy handles can hide problems. One domain getting hammered while another is quiet just averages out. Per-domain tracking lets you see and respond to each independently.
Plain-text mail logs compress beautifully — typically to 10% or less of their original size. Spam Killer's compress_rotated option turns this into a free 10-20x retention multiplier without touching your existing log tooling.
For most deployments, the Python implementation handles inbound mail with room to spare. But high-volume providers and shared hosts running thousands of domains needed something more efficient. The C version exists for those workloads.
The List-Unsubscribe header used to be a polite courtesy. Then Gmail and Yahoo made it mandatory. Here's what RFC 8058 actually requires and why its presence is now one of the strongest signals that mail is legitimate bulk.
Email authentication standards are the foundation of a spam-free inbox. Here's what each one does, how they work together, and what happens when any one of them is missing.
Routing your inbound email through a spam proxy is a two-minute DNS change. We walk through the exact steps for GoDaddy, Cloudflare, Route 53, and Namecheap.
Self-hosting a spam filter gives you control. Outsourcing it gives you your time back. We lay out the real trade-offs so you can make the right call for your organization's size and risk tolerance.
Bayesian classifiers are one of the most effective tools in the anti-spam arsenal. Here's the math behind why they work, how you train them, and what makes them improve with use.
Spam is annoying. Phishing is dangerous. The detection techniques that catch bulk spam often miss carefully crafted phishing emails — here's why, and what to do about it.
Managing email for multiple domains under one roof? Here's how to give each domain its own upstream server, spam threshold, SPF policy, and greylisting settings — without touching the others.
If nearly a third of your inbound email is spam, you're paying for it whether you realize it or not — in storage, bandwidth, IT overhead, and employee attention. Here's the real annual figure for a 50-person company.
Greylisting works because spambots don't play by the rules. Legitimate mail servers retry. Most spammers don't. Here's how a 5-minute delay catches what classifiers miss.
BEC attacks cost businesses billions every year. Unlike mass spam, they're targeted, low-volume, and carefully crafted. Here's what makes them so effective — and which defenses actually work.
Whitelisting a vendor or partner is sometimes necessary — but doing it carelessly creates a hole in your defenses. Here's the right way to grant trusted access while keeping your policies intact.
A sudden flood of inbound connections can bring down an unprepared mail server. Per-IP rate limiting at the proxy layer stops volumetric attacks before a single byte reaches your infrastructure.
For managed service providers, spam filtering is a natural fit. Low support burden, high perceived value, and sticky recurring revenue. Here's how MSPs are packaging and reselling proxy-based spam filtering.
Every spam filter checks for "spam phrases" — but what are they, exactly? We break down the categories of heuristic signals, from suspicious URLs and hidden text to homoglyph attacks and base64-encoded links.
Need to catch something specific — crypto scam keywords, your competitor's name being used as a lure, or an industry-specific phishing pattern? Custom regex rules let you target exactly what your business sees.
Training employees to "just delete spam" is not a strategy. Spam filter failures are a failure of infrastructure. Here's how moving filtering upstream — before email hits your server — changes the equation entirely.
Your spam filter processes thousands of messages a day. Prometheus metrics and a pre-built Grafana dashboard turn that stream of events into actionable visibility — spam rates, auth failures, top sender domains, and more.
TLS encrypts email in transit — but it doesn't tell you anything about whether that email is spam. Here's a clear breakdown of what transport-layer security solves and where it stops.
Switching your MX records feels risky. Done right, it's seamless. Here's the exact sequence for a zero-downtime migration to a proxy-based spam filter, including how to roll back safely if something goes wrong.
Remote work expanded the email attack surface dramatically. Employees on home networks, personal devices, and consumer ISPs face different threat patterns than office workers. Here's how proxy-based filtering adapts.
Every message processed by Spam Killer gets X-Spam-Status and X-Spam-Score headers. Here's how to use those headers to build smart sorting rules in Exchange, Gmail, Outlook, Thunderbird, and Apple Mail.