Using filters with relay addresses

Filter rules work on relay-protected addresses just like they do on aliases, with one key difference: relay filters can only use the deny action. This article explains how to use filters effectively on relay addresses.

Why only deny?

Alias filters support both allow (with delivery options like folder routing and flags) and deny. Relay filters only support deny because relay addresses forward to your own mail server — Cleanbox does not control the destination IMAP folder or flags. Your mail server handles that.

The purpose of relay filters is to block unwanted email before it reaches your server.

Creating a relay filter

1. Navigate to Filters
2. Click Add filter
3. Set your conditions (sender, subject, category, spam score, etc.)
4. The action is automatically set to deny for relay addresses
5. Save

All the same condition components are available: from, from_name, sender, subject, body, header, property, category, spam_score, and spam_symbol.

Effective relay filter strategies

Block by category

If your business domain receives unwanted marketing or social media notifications:

• Condition: category equals Discounts & Promotions
• Action: Deny

Block by spam symbols

Target specific spam patterns that your threshold does not catch:

• Condition: spam_symbol contains DKIM_FAIL
• Action: Deny

Block by sender pattern

Block entire domains or patterns:

• Condition: from matches @(marketing|promo|deals).
• Action: Deny

Filter order matters

Relay filters are evaluated in the same priority order as alias filters — first match wins. If a filter denies the message, no further filters are evaluated. Place your most specific filters at the top.

Interaction with other relay features

• Contact states — A blocked contact is denied before filters are evaluated. A whitelisted contact still goes through filters (but skips spam checks).
• Spam threshold — Checked before filters. A message rejected by the spam threshold never reaches filter evaluation.
• DNSBL checks — IP blacklist rejection happens at the connection level, before any filter runs.

Filters are your tool for content-based blocking on relay addresses — catching things that IP blacklists and spam scores miss.