Spam & phishing protection

Server-side scoring quarantines threats before they reach your inbox.

Every message is scored for threats on the server before it reaches your inbox — so dangerous mail never gets the chance to cause harm.

Why server-side scoring matters

Email content is treated as untrusted input. Scoring runs server-side at sync time, before a message is ever rendered in a client, because client-side analysis happens too late — a malicious tracking pixel or a credential-harvesting link can do damage the moment the message is opened.

The scorer is deterministic: the same message always produces the same numeric score and the same plain-English reason. There are no black-box ML hunches for clear-cut cases.

AI is used only for borderline cases

An AI tie-break step runs only when the deterministic score falls in the 0.5–0.8 range. Clear spam (score > 0.8) and clearly legitimate mail (score < 0.5) are handled entirely by the rule-based scorer without any model call.

What the scorer checks

The deterministic scorer weighs several independent signals and produces a composite score between 0 and 1. A score above the sensitivity threshold quarantines the message to the Spam folder.

Signal	What is checked
SPF / DKIM / DMARC	Email authentication headers; a failing DMARC record on a known brand is a strong spam signal
Brand impersonation	Display-name spoofing, lookalike domains, mismatched From/Reply-To
Scam & phishing language	Urgency cues, prize claims, password-reset pretexts, credential requests
Deceptive links	Redirect chains that resolve to different domains, URL shorteners pointing to flagged hosts
Risky attachments	Executable file types, macro-enabled Office docs, password-protected archives
Sender reputation	Domain age, prior quarantine history, presence on shared block lists

What happens when a message is quarantined

Quarantined messages move to the Spam folder. They are excluded from the unified inbox, from rule evaluation, and from AI agent actions. Each quarantined message shows its numeric score and a plain-English reason — for example, “Failed DMARC on a domain impersonating your bank.”

Nothing is deleted automatically. Quarantined messages are retained for 30 days, after which they are permanently removed.

Quarantined messages are excluded from rules

Inbox rules (including label rules and forward rules) do not run on quarantined messages. If a legitimate message is wrongly quarantined, rescue it first with “Mark Not-spam” — the rule will then apply to future messages from that sender.

Adjusting sensitivity and managing lists

Settings → Rules → Spam gives you three controls: sensitivity level, an allow-list, and a block-list.

Standard (default): quarantines messages with a score above 0.8. Suitable for most users.

Strict: lowers the threshold to 0.6, catching more borderline cases at the cost of a slightly higher false-positive rate. Recommended if you receive frequent phishing attempts.

Changing sensitivity takes effect on new arrivals only; existing Spam folder contents are not rescored.

Frequently asked

Feature overview

AI Spam Protection

Ready to try it?

Start free