Filters can act during mail transfer or after receipt and may combine sender and infrastructure reputation, volume patterns, authentication results, message content, links, attachments, recipient feedback, and campaign relationships.
Whether a message is unwanted can depend on consent, subscription state, local policy, and recipient context. Layered signals, transparent quarantine and appeal paths, user reporting, and measured tuning help operators reduce disruption while responding to changing senders and evasion techniques.
Key points
Signals and actionsCombine connection, sender, authentication, behavioral, content, and recipient-specific evidence; choose proportionate actions and avoid relying on one score or blocklist.
OperationsMonitor delivery and complaint patterns, expire stale rules, review quarantines, protect high-risk mailboxes, and provide safe mechanisms to report, release, or permanently block messages.
Privacy and usabilityLimit collection and retention of message data, restrict analyst access, explain user-visible labels, and account for legitimate bulk, transactional, emergency, and accessibility-related mail.
Important limitationEvery filter has false positives and false negatives, and adversaries adapt to detection. Authentication can support a decision but does not make a message wanted or benign; filtering also cannot eliminate all deceptive interaction.