Antispam

Incoming mail is scored by Rspamd. Every message accumulates points from dozens of checks — reputation, DNS blocklists, SPF/DKIM/DMARC results, content, greylisting — and the total decides what happens to it.

CorePanel exposes two controls on top of that: thresholds and allow/deny lists, each settable at three levels.

The three thresholds

Action	Default score	What it does
Greylist	4	Temporarily defers the message; a legitimate sender retries and gets through, most spam bots do not
Add header	6	Delivers the message, marked as spam so a filter or the mail client can file it
Reject	15	Refuses the message at SMTP time

Rejecting at SMTP time is the honest option: the sender gets an error and knows the mail did not arrive. That is why the reject threshold is high — a false positive here means losing a real message with no copy anywhere.

Choosing thresholds

• Lower the reject score (say to 12) only when you are confident about your mail flow, and after watching what a lower score would have caught.
• Lower the add-header score to mark more aggressively; it is a safe knob, since nothing is lost — the message is still delivered.
• Raise the greylist score if legitimate senders complain about delays.

Leaving a threshold at zero means “use the default”, so a policy only has to carry the values you actually want to change.

Three levels

Scope	Applies to
Server	Every domain hosted here
Domain	One domain
Mailbox	One address

The most specific scope wins: a mailbox policy overrides its domain’s, which overrides the server’s. That is what lets one demanding address (abuse@, support@) be more permissive than the rest of the server without weakening everything.

Allow and deny lists

Beyond scores, you can name senders explicitly:

List	Effect
Allow	Mail from this sender is never actioned as spam, whatever it scores
Deny	Mail from this sender is always rejected, whatever it scores

Entries are full email addresses, and a sender can appear only once per scope — allow and deny are mutually exclusive there. Lists take precedence over thresholds at every level, and a more specific scope’s list wins over a broader one.

Allow lists are forgeable

An allow entry matches the sender address, and sender addresses are trivial to forge. An allow-listed address is a permanent opening for anyone willing to spoof it. Use allow entries to fix a specific recurring false positive — a supplier, a monitoring system — not as a general “trusted senders” list.

A practical order of operations

When a customer says “we are getting too much spam”:

1. Look at what is actually arriving and what it scores. If it is scoring 7–12, it is being marked but delivered — the threshold is doing its job and the mail client should be filing it.
2. Lower the add-header threshold on that domain before touching reject.
3. Only then consider a lower reject threshold, and only for that domain.

When they say “a message never arrived”:

1. Check whether it was rejected (the sender has a bounce with a reason) or marked.
2. If it was rejected, add an allow entry for that sender at the narrowest scope that fixes it — mailbox before domain, domain before server.
3. If it keeps happening across many senders, the threshold is too aggressive rather than any one sender being wrong.

Outgoing mail

Antispam settings govern incoming mail. Whether your outgoing mail is accepted elsewhere depends on SPF, DKIM and DMARC — see email authentication — and on the reputation of the server’s IP address.