Advanced filtering: combining conditions and groups

Basic filters with a single condition cover most use cases. But when you need more precision — matching multiple criteria, excluding certain senders, or using pattern matching — Cleanbox's advanced filtering features give you full control.

Combining conditions with ANY / ALL

When a filter has multiple conditions, you choose how they are combined:

Logic	Behavior	Use when
ALL (AND)	Every condition must match	You want to narrow down to very specific emails
ANY (OR)	At least one condition must match	You want to catch emails matching any of several criteria

Example: ALL logic

Deny emails that are both from @marketing.com AND have "promo" in the subject:

• Logic: ALL
• Condition 1: from ends_with @marketing.com
• Condition 2: subject contains promo
• Action: Deny

An email from @marketing.com with subject "Your order shipped" would not be denied, because it doesn't contain "promo".

Example: ANY logic

Deny emails from any of three spam domains:

• Logic: ANY
• Condition 1: from ends_with @spam-a.com
• Condition 2: from ends_with @spam-b.com
• Condition 3: from ends_with @spam-c.com
• Action: Deny

Rule groups

For complex scenarios, you can create multiple rule groups within a single filter. Each group has its own set of conditions and its own ANY/ALL logic. The groups are combined with AND logic.

This lets you build filters like: "Match emails where (sender is from @example.com OR @example.org) AND (subject contains 'sale' OR 'discount')"

• Group 1 (ANY): from ends_with @example.com / from ends_with @example.org
• Group 2 (ANY): subject contains sale / subject contains discount

Using regex patterns

For maximum flexibility, select the matches operator. This lets you use regular expressions for pattern matching.

Common regex examples

Pattern	What it matches
@(spam|junk|promo).	Senders from domains starting with spam, junk, or promo
^(Invoice|Receipt|Order)s#?d+	Subjects starting with Invoice, Receipt, or Order followed by a number
noreply|no-reply|donotreply	Senders with any variation of "no reply" in their address
.(ru|cn|xyz)$	Senders from .ru, .cn, or .xyz domains

Tip: Regex is powerful but can be tricky. Test your filter against existing messages before relying on it (see the testing guide).

Filtering by category

Cleanbox automatically categorizes contacts based on their domain. You can use these categories as filter conditions. The 20 built-in categories include:

Social Networks, Shopping, Entertainment, Finance, Travel, Education, Food Delivery, Logistic Services, Business Services, News & Magazines, Gaming & Gambling, Internet & Communication, Discounts & Promotions, Restaurants & Dining, Events & Tickets, Productivity & Tools, Hobbies & Interests, Home & Supplies, Fun & Activities, and Adult.

Example: Move all Shopping to a folder

• Condition: category equals Shopping
• Action: Allow
• Option: Store in folder → Shopping

Example: Deny all Discounts & Promotions

• Condition: category equals Discounts & Promotions
• Action: Deny

Filtering by spam score and symbols

Spam score

• Condition: spam_score greater_than 8
• Action: Deny

This is more aggressive than the per-alias threshold (which quarantines). This filter outright denies high-scoring messages.

Spam symbols

Spam symbols are specific rules that triggered during analysis. You can filter on them to target specific patterns:

• DKIM_FAIL — The sender's DKIM signature failed verification
• SPF_FAIL — The sender's SPF record doesn't authorize the sending server
• BAYES_SPAM — Bayesian analysis classified the content as spam

Combining filters with contact states

Filters and contact states work together in the evaluation chain:

1. Contact states are evaluated first — a whitelisted contact bypasses all filters
2. Filters are evaluated in order — first matching filter wins
3. Spam threshold is evaluated last — if no filter matched

This means you can use contact states for broad sender-level decisions and filters for content-level precision.