Filter samples: 8 practical use cases for everyday email

Cleanbox includes 50+ pre-built filter samples accessible via the "Use sample" button in the filter editor. This article walks through 8 of the most useful ones to show how filters can transform your inbox.

1. Move newsletters to a folder

Sample: Mark all newsletters as read

Newsletters are detected by the NEWSLETTER property (presence of a List-Unsubscribe header). This sample catches all newsletter-type emails and marks them as read so they do not clutter your unread count.

Rule: Property is Newsletter
Action: Allow, mark as read

Customize it: Change the action to deliver to a "Newsletters" folder instead of marking read, so you can browse newsletters when you have time.

2. Sort shopping receipts to a folder

Sample: Move order confirmations or receipts to folder

Uses two rule groups with ANY logic between them:

Group 1: Subject contains "order confirmation" OR "your order has been"
Group 2: Subject contains "receipt" AND has attachments
Action: Allow, deliver to "Orders" folder

The second group requires both "receipt" in the subject AND an attachment, which avoids catching random emails that mention "receipt" without actually being one.

3. Flag invoices with attachments

Sample: Flag invoices and statements with attachments

Group 1: Subject contains "invoice" AND has attachments
Group 2: Subject contains "statement" AND has attachments
Action: Allow, mark as flagged

Flagged messages appear highlighted in your email client, making them easy to find when doing accounting or expense tracking.

4. Block phishing and lottery scams

Sample: Block phishing attempts or lottery scams

Two-pronged defense:

Group 1: Spam symbol PHISHING exists OR subject matches "(verify your account|suspended account|unusual activity)"
Group 2: Body matches "(lottery|jackpot|you have won|claim your prize)" AND spam score > 1
Action: Deny

The spam score condition in Group 2 prevents false positives — a legitimate email mentioning "you have won" (like a contest you actually entered) would need to also have a spam score above 1 to be blocked.

5. Block emails with hidden text tricks

Sample: Block coded or obfuscated spam

Rule: Spam symbol ZERO_FONT exists OR spam symbol MANY_INVISIBLE_PARTS exists
Action: Deny

Zero-font and hidden parts are techniques spammers use to confuse content-based filters. No legitimate email needs invisible text. This is a very safe deny rule with almost no false positive risk.

6. Flag security alerts from real services

Sample: Flag security alerts from real services

Group 1: Subject matches "(security alert|suspicious sign-in|new login)" AND is NOT a newsletter
Group 2: Subject contains "password reset" AND is NOT a newsletter
Action: Allow, mark as flagged

The "not newsletter" condition is key — phishing emails often look like security alerts but are sent as bulk marketing. Real security notifications from Google, Apple, or your bank are not newsletters.

7. Block suspicious attachments from shady domains

Sample: Block suspicious attachments from spam or shady domains

Group 1: Has attachments AND is NOT newsletter AND spam score > 3
Group 2: Has attachments AND sender domain matches \.(xyz|top|click|buzz|icu|club|loan|work)$
Action: Deny

The regex in Group 2 blocks attachments from TLDs commonly associated with spam. These domains cost pennies to register and are disproportionately used for malware distribution.

8. Move promotional emails to a folder

Sample: Move promotional emails to folder

Group 1: Category is "Discounts & Promotions" AND is a newsletter
Group 2: Subject matches "(% off|discount|sale ends|limited offer)" AND is a newsletter
Action: Allow, deliver to "Promotions" folder

Combines category-based matching (catches known promo senders) with content matching (catches promo emails from senders not yet categorized).

How to apply a sample

Go to Filters → create or edit a filter
Click Use sample
Browse and select a sample
Review the pre-filled rules and customize if needed
Save the filter

Samples are starting points. You can add conditions, change actions, or combine with other samples. For the full component and operator reference, see Filter components and match types reference.