Setting a spam threshold per alias
Every email processed by Cleanbox is assigned a spam score — a number that indicates how likely the message is to be spam. You can set a custom spam threshold per alias to control how aggressively Cleanbox filters incoming messages.
How spam scoring works
When an email arrives, Cleanbox analyzes it using multiple signals:
- Content analysis — Suspicious phrases, misleading formatting, known spam patterns
- Header validation — SPF, DKIM, and DMARC checks on the sender's domain
- Sender reputation — IP blacklist lookups against DNSBL providers (Spamhaus, Barracuda, SpamCop)
- Link analysis — URLs pointing to known phishing or malware domains
- Pattern matching — Comparison against known spam signatures
Each signal adds points to the score. The higher the score, the more likely the message is spam. A typical legitimate email scores between 0 and 2. Marketing emails may score 3–5. Obvious spam often scores 10 or higher.
What the threshold does
The spam threshold is the cutoff point. When a message's spam score exceeds the threshold:
- The message is quarantined instead of delivered
- It appears in your quarantine inbox for review
- You can manually deliver it if it turns out to be legitimate
Messages below the threshold are delivered normally (assuming they pass your other filters and contact rules).
Setting a threshold per alias
- Navigate to Aliases in the sidebar
- Click on the alias you want to configure
- Find the spam threshold setting
- Adjust the value and save
Recommended thresholds
| Use case | Threshold | Behavior |
|---|---|---|
| Public alias (website, forums) | 3–4 | Aggressive. Catches most spam but may quarantine some legitimate marketing emails. |
| Shopping / signups | 5–6 | Balanced. Good for aliases used on e-commerce and online services. |
| Personal / trusted services | 7–8 | Lenient. Only obvious spam is quarantined. Best when you trust most senders. |
| Internal / business | 9–10 | Very lenient. Almost nothing is quarantined. Use when false positives are unacceptable. |
Viewing spam reports
Every processed message includes a detailed spam report. You can view it from the message detail page. The report shows:
- The total spam score
- Every individual rule that triggered, with its score contribution
- Authentication results (SPF, DKIM, DMARC pass/fail)
- Blacklist hits, if any
This transparency helps you understand why a message was quarantined and lets you make informed decisions about adjusting your threshold.
Threshold vs. contact rules
Spam thresholds and contact rules work together but serve different purposes:
- Spam threshold — Evaluates the message content. A low threshold catches more spam regardless of who sent it.
- Contact rules — Evaluates the sender. A whitelisted contact bypasses spam evaluation entirely, regardless of the threshold.
For best results, combine both: set a reasonable threshold for unknown senders, and whitelist contacts you trust. This gives you strong spam protection without false positives from known senders.
Fine-tuning over time
Start with the recommended threshold for your alias type and adjust based on experience:
- Too many false positives? (legitimate emails in quarantine) — Raise the threshold by 1–2 points
- Too much spam getting through? — Lower the threshold by 1–2 points
- Specific sender keeps getting quarantined? — Whitelist them via contact rules instead of raising the threshold globally
Check your quarantine regularly. Patterns in false positives can guide your threshold adjustments and help you identify senders that should be whitelisted.
