SpamExperts offers various Filter settings, which can be used to influence the handling of incoming emails. These include spam quarantine, thresholds for spam classification, as well as checks for SPF, DKIM, and DMARC.
Just because these settings can be changed doesn't mean they should be changed.
CURIAWEB recommendation: Generally, keep the SpamExperts filter settings at their default values. The filter is already pre-configured very well. Changes should only be made if there is a specific and understandable problem and the effects of the change are known.
Where can I find the filter settings? #
The filter settings are managed at the domain level.
Open in the SpamExperts Control Panel:
Incoming → Protection Settings → Filter settings
The settings apply to the selected domain.
If you manage multiple domains, therefore carefully check before every change that you are in the correct domain.
We explain how to open the SpamExperts Control Panel at Login to the SpamExperts Dashboard via the CURIAWEB Customer Center.
Why shouldn't I change the default values? #
A spam filter does not evaluate messages based on a single feature. Various checks and classification mechanisms work together to distinguish legitimate messages from spam and other unwanted emails.
If a setting is changed without a specific reason, not only can the desired behavior change as a result.
For example, a more aggressive configuration can cause more legitimate messages to be treated as spam. Conversely, a less strict configuration can cause more unwanted messages to be delivered.
Therefore:
Single misclassification
≠
Filter fundamentally misconfiguredIn the case of a single problematic message, the specific cause should be investigated first.
An overview of the most important filter settings #
Which options are displayed can depend on the SpamExperts version or the available feature set. Among the central settings are:
- Quarantine enabled
- Quarantine threshold
- Beneficial to train threshold
- Sender checks for SPF, DKIM, and DMARC
- Maximum Line Length Check
- Review of newly registered domains
- PTR check sending mail server
- Beneficial to train notation
- Quarantine response
- TLS Settings
Some of these settings directly affect how SpamExperts classifies or handles incoming messages.
Quarantine enabled #
With Quarantine enabled spam quarantine is activated or deactivated.
When quarantine is enabled, messages classified as spam can be held there and subsequently reviewed.
Attention: Do not simply deactivate the quarantine just because you do not want to check it regularly. According to SpamExperts, with the quarantine deactivated, messages identified as spam are forwarded to your mail server. By doing this, you would alter an essential part of the intended spam processing.
We explain how to check withheld messages under Using Spam Quarantine in SpamExperts.
Quarantine Threshold #
The Quarantine Threshold is a threshold for spam classification.
SpamExperts uses a combined score for this. If a message is above the set threshold, it is classified as spam and treated accordingly.
The default value recommended by SpamExperts is:
0.9
The direction of the scale is important here:
| Change | Impact |
|---|---|
lower value direction 0.0 | Filter is becoming more aggressive; more messages may be classified as spam |
higher value direction 1.0 | Filters are becoming less aggressive; more spam may be delivered |
CURIAWEB recommendation: Leave the quarantine threshold at the recommended default value. Do not change it based on a single spam email or a single false positive.
Why „stricter“ is not automatically better #
It can be tempting to lower the threshold significantly if spam occasionally lands in your inbox.
However, at the same time you increase the risk that legitimate messages are classified as spam.
Conversely, while a significantly higher value can reduce false positives, it may at the same time allow more spam to pass through.
Therefore, the correct reaction to a single misclassification is not:
Spam received
↓
Change thresholdRather:
Spam received
↓
Examine message
↓
Check Log Search
↓
Train as spam if necessaryWe explain how this works at Train SpamExperts Filter: Report spam and ham correctly.
Beneficial to train threshold #
SpamExperts additionally uses a Beneficial to train threshold.
Messages whose combined score lies between this threshold and the quarantine threshold can be classified by the filter as unsafe or as useful for possible training.
However, this does not mean that every correspondingly marked message needs to be trained.
Important: A legitimate message does not need to be trained as ham solely because SpamExperts classifies it as „Beneficial to train.“ SpamExperts explicitly points out that legitimate messages with this classification do not necessarily have to be trained.
Beneficial to train notation #
For appropriately classified messages, SpamExperts can use a tag in the subject line.
This Beneficial to train notation makes it visible that SpamExperts has classified the message as suspicious or insecure without treating it as spam.
Such a label is an indication for evaluating the message—not proof that the email is dangerous or unwanted.
SPF check #
SPF (Sender Policy Framework) allows a domain to publish via DNS which systems are authorized to send its emails.
SpamExperts can take this information into account when checking incoming messages.
SPF checks should generally remain enabled.
Attention: Do not disable SPF checking just because a specific legitimate message causes an SPF failure. An SPF failure can indicate a misconfiguration at the sender's end. A global disable would also turn off the check for other messages.
We cover the setup of SPF for sending via SpamExperts at Properly setting up and checking SPF for SpamExperts.
DKIM Check #
DKIM (DomainKeys Identified Mail) allows a sending system to cryptographically sign certain components of an email.
The receiving filter can use the published DKIM key to check whether the signature is valid.
This check should also generally remain enabled.
DMARC check #
DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM and additionally takes into account the alignment of relevant domains.
A published DMARC policy can also inform the receiving system how to handle messages that fail the corresponding checks.
The DMARC check is an important part of modern email authentication and should not be disabled without a specific technical reason.
Disable SPF, DKIM, or DMARC for individual senders? #
SpamExperts offers the possibility to exclude SPF, DKIM, and DMARC checks for specific domains, IP addresses, or networks.
This function should be used with extreme caution.
Such an exception means that a failed authentication check for the defined scope is no longer handled in the normal way.
CURIAWEB recommendation: Do not create exceptions for SPF, DKIM, or DMARC just to make a misconfigured sender domain „work.“ Such exceptions can increase the risk of spoofed messages being delivered.
Maximum Line Length Check #
E-mail messages are subject to technical standards. This also includes a maximum permissible line length.
Some poorly configured applications or scripts generate messages that violate these specifications.
SpamExperts can check corresponding messages.
The examination should generally remain activated.
Deactivation can also cause SpamExperts to forward a technically problematic message that the actual target mail server subsequently rejects anyway due to the invalid format.
Newly registered domains #
SpamExperts can treat or reject messages from very newly registered domains in a special way.
Such domains are frequently used in short-term spam and phishing campaigns.
The current SpamExperts configuration therefore offers a setting to reject messages from newly registered domains.
SpamExperts recommends activating this feature as an additional measure against so-called zero-day spam.
PTR check sending mail server #
A PTR record is used for reverse DNS and maps an IP address to a hostname.
SpamExperts can check whether the sending mail server has a valid PTR record.
If the corresponding setting is enabled, messages from sending mail servers without a valid PTR record can be treated or quarantined accordingly.
This also applies here: If a single legitimate sender causes problems due to a faulty mail server configuration, the global check for all senders should not be disabled hastily.
Quarantine Response #
With Quarantine response it is determined which SMTP response the sending mail server receives when a message is recognized as spam and quarantined.
SpamExperts offers this, among other things:
| Setting | Behavior |
|---|---|
| Accepted | The message is quarantined; the sending server does not receive a rejection due to this quarantine status. |
| Rejected | The message is quarantined and the sending server receives an SMTP rejection at the end of the transmission. |
SpamExperts refers to Rejected as the standard recommended setting.
Important: Do not change this setting without understanding the impact on SMTP responses and potential non-delivery reports.
TLS Settings #
SpamExperts supports TLS for the encrypted transmission of emails, provided that the participating systems support TLS.
Additional TLS requirements can be defined for specific senders or recipients via the filter settings.
If TLS is mandatory and a corresponding TLS connection cannot be established, the message cannot be processed or delivered normally.
Such settings should therefore only be changed if the technical requirements of the respective communication partner are known.
DANE #
SpamExperts also supports settings related to DANE and DNSSEC.
DANE can provide additional security mechanisms for the TLS encryption of email transport.
However, an incorrect DANE configuration can cause delivery to be blocked.
Therefore, the same applies here: Do not activate or change just because the option is available.
A legitimate message ends up in quarantine – what to do? #
Do not change the quarantine threshold immediately.
Proceed like this instead:
- Clearly identify the message in question.
- Check them in the spam quarantine.
- Search for the message about log search.
- Check the classification and existing notes.
- Release the message if necessary.
- Check if targeted ham training is beneficial.
- Only consider further measures in the event of recurring, verifiable problems.
We explain the use of quarantine under Using Spam Quarantine in SpamExperts.
Spam is getting through – what can I do? #
Even a single spam mail in the inbox is no reason to lower the quarantine threshold immediately.
First, check whether the message was actually processed via SpamExperts.
Use the SpamExperts Log Search.
If the message was processed by SpamExperts but misclassified, it can be trained as spam if necessary.
If the message did not go through SpamExperts at all, the problem may lie in the delivery route rather than the filter strength.
Many false positives – set filters less strictly? #
Even in the event of multiple false positives, the threshold should not be changed as a first measure.
First, collect several concrete examples and examine commonalities.
Particularly helpful are:
- Sender
- Recipient
- Date and time
- Classification
- SPF/DKIM/DMARC results
- further information from the log search
Only on the basis of concrete data can it be assessed whether a systematic problem actually exists.
Why global changes are more problematic than targeted measures #
A global filter setting doesn't just affect the single message you made the change for.
It can affect all incoming email traffic for the domain.
That is why we prefer targeted measures for specific problems:
| Problem | Check first |
|---|---|
| A legitimate message was detected as spam | Quarantine, log search, ham training if necessary |
| A spam email was delivered | Log Search, Spam training if necessary |
| Specific legitimate sender repeatedly affected | Cause and, if applicable, targeted sender allowlist |
| A specific sender should be blocked | Sender Block List |
| Messages do not appear in SpamExperts at all | MX Configuration and Message Path |
We explain how to specifically approve a legitimate sender at Sender Allow List: Allow senders in SpamExperts.
For targeted blocks, you can find the instructions under Sender Block List: Block senders in SpamExperts.
Do not change multiple settings at the same time #
If a change is actually necessary, you should not modify several filter parameters at the same time.
Otherwise, it will hardly be possible to determine afterwards which change caused which behavior.
A controlled procedure is:
Document problem
↓
Analyze cause
↓
Confirm need for change
↓
Implement targeted change
↓
Observe impact
↓
Document resultWhat to do if you are unsure about a setting? #
If you are not sure exactly what effect a filter setting has, you should not change it.
Instead, note down the specific problem and a few sample messages.
For an analysis, sender, recipient, dispatch time, and the information from the log search are particularly helpful.
Basic rule: A visible setting is not an invitation to optimize it. At SpamExperts, the default values are deliberately intended as an initial configuration.
Summary #
The SpamExperts Filter Settings control important areas of incoming email filtering, including quarantine, spam thresholds, SPF, DKIM, and DMARC checks, as well as other security and transport functions.
The Quarantine Threshold has a recommended default value of 0.9. A lower value makes the filtering more aggressive, a higher value less aggressive. SpamExperts itself advises against making major changes to this value.
Security checks such as SPF, DKIM, and DMARC should also not be deactivated without a specific technical reason.
CURIAWEB therefore explicitly recommends keeping the SpamExperts filter settings at their default values in principle.
For individually misclassified messages, you should first use quarantine and log search, and if necessary, apply targeted spam or ham training. Global changes only make sense once a concrete, reproducible problem exists and the effects of the change are fully understood.
