Spam dies before it reaches your inbox.
Multi-layer detection powered by Rspamd, AI content analysis, ClamAV virus scanning, and crowd-sourced sender reputation. Per-alias thresholds, quarantine for borderline messages, and contact states that learn from your decisions.
AI understands context
Our AI reads the email and catches brand impersonation, sextortion, and scams that word-counting filters miss.
Crowd-sourced intelligence
Feedback from thousands of users builds sender reputation. When a spammer targets one user, everyone is protected.
Your threshold, your rules
Set sensitivity per alias. Aggressive on public addresses, relaxed on personal ones. Quarantine borderline messages for review.
Rspamd — the engine
Every email is processed by Rspamd, one of the most advanced open-source spam scanning engines. It runs dozens of checks in parallel and produces a total spam score from hundreds of individual rules:
- Bayesian classifierMachine learning trained on millions of messages, continuously improved by user feedback
- AuthenticationSPF, DKIM, DMARC verification catches forged senders
- URL reputationEvery link is checked against phishing and malware databases
- Content rulesZero-font tricks, hidden text, phishing layouts detected
- Fuzzy hashingMatches against known spam fingerprints, even with modified text
AI content classification
Traditional spam filters count words. Our AI reads the email and understands what it says. It catches threats that statistical filters miss because it recognizes context, intent, and deception:
- Brand impersonationKnows that paypal-support-center.com is not paypal.com
- Social engineeringRecognizes urgency, threats, and manipulation tactics
- Scam structuresIdentifies sextortion, fake invoices, and advance fee fraud patterns
- Plain-English explanationEvery email gets a X-Cleanbox-Explanation header explaining the verdict
The AI works with Rspamd, not against it. When both agree, the score is high. When they disagree, the score is cautious. No bulldozing legitimate email.
ClamAV virus scanning
For relay addresses, every inbound email is scanned by ClamAV before any other processing. Viruses, trojans, ransomware, exploit kits, and malicious scripts in attachments are caught and rejected before they reach your mail server.
- Real-time scanning of all attachments and embedded content
- Signature database updated multiple times per day
- First step in the evaluation chain — viruses caught before spam checks
- Infected messages logged with the exact virus signature name
Crowd-sourced sender reputation
Cleanbox aggregates feedback from all users to build sender reputation scores. When a spammer targets multiple Cleanbox users, the first few reports trigger automatic protection for everyone else:
- CLEANBOX_BLOCK (+8.0)10+ users reported this sender, 90%+ spam ratio. Near-certain spam.
- CLEANBOX_TRUSTED (-2.0)5+ teams whitelisted this sender. Protects against false positives.
- CLEANBOX_BULK_ESP (+0.5)Sent via known bulk email infrastructure. Slight score increase.
The more users Cleanbox has, the faster the response. Your feedback trains the filter for everyone.
Per-alias thresholds and quarantine
Not every alias needs the same sensitivity. Your public-facing contact alias might need aggressive filtering (threshold 3), while your personal alias can be relaxed (threshold 8).
Enable the quarantine zone on any alias. Messages scoring between your quarantine and reject thresholds are held for review. Accept false positives, reject actual spam, and train the filter with every decision.
- Independent thresholds per alias or relay address
- Quarantine for borderline messages
- Bulk accept/reject from the quarantine dashboard
Contact states — your permanent decisions
Every sender becomes a contact. Set their state to control how all future email from them is processed:
- WhitelistedBypasses spam checks entirely. Trusted senders never get flagged.
- BlockedAll email rejected immediately. No processing, no delivery.
- MutedDelivered but marked as read. Present but silent.
- PrioritizedFlagged as important, bypasses Shield delivery windows.
Combined with 20 automatic categories (Shopping, Finance, Social, etc.), contact states give you permanent control without managing individual emails.
Stop spam before it starts
All spam protection features are included on every plan, including Free. AI classification, Rspamd, crowd-sourced reputation, and quarantine — no upgrade needed.
Get started free