Understanding spam and junk — whitelist, blacklist and quarantine

Spam filtering in the Mailcow setup is organized on two levels:

1. Server level (that’s us): Rspamd, SpamAssassin and ClamAV check every incoming mail for spam indicators and viruses. Depending on configuration, mail with a high spam score is accepted, put into quarantine or rejected outright.
2. Domain level (you as domain admin): whitelist and blacklist for your domain — always let specific senders through, or always block them.

Here we explain what you can actually do as domain admin and account user.

How Mailcow detects spam

Every incoming mail gets a spam score. Factors:

• DKIM, SPF, DMARC of the sender — if all three are missing or wrong: high score.
• Sender reputation: listings on known spam lists, how many complaints exist for the IP.
• Content indicators: spam-typical words, lots of capital letters, suspicious links.
• Behavior: extreme volumes from the same sender, no prior correspondence.

The score is a number between 0 and roughly 20. Default thresholds:

Score	Meaning
0–4	no spam indicators, normal mail
4–8	suspicious, marked as “possible spam”, but lands in the inbox
8–12	clearly spam, lands in the Junk folder or in quarantine
12+	definitely spam, gets rejected — sender receives a bounce

We tune the exact thresholds on the server level. As domain admin you see each mail’s score in the mail log and in the headers (X-Spamd-Score).

When legitimate mail lands in Junk

Classic case: someone writes to you, the mail doesn’t reach the inbox because it was filed as spam. Here’s how to find it:

In SOGo webmail

Click the Junk or Spam folder on the left. Mail sits there for 30 days before it gets deleted.

Select the mail → click Not spam (or use the keyboard shortcut j for “remove junk status”). The mail lands in the inbox, and SOGo learns: this sender is not spam.

In the Mailcow quarantine

If a mail was rejected by the server or put into deeper quarantine, you find it in the Mailcow GUI → Email → Quarantine.

There you see:

• Recipient: which mailbox of your domain the mail went to
• Sender
• Subject
• Spam score
• Size

Actions per mail:

• Release: deliver to the recipient
• Discard: gone for good
• Whitelist: add the sender to the domain whitelist, future mail from there gets through

Whitelist and blacklist as domain admin

In the Mailcow GUI, Configuration → Black/White lists (also “Blacklist/Whitelist”) sets domain-wide rules:

Whitelist

• Enter an address or domain: vertrauenswürdig@firma.de or *@vertrauenswürdig.de.
• Mail from this address / domain always gets through, no matter its spam score.

Useful for example for:

• Newsletter providers that carry high spam scores but are legitimate
• External business partners whose mail-server setup isn’t entirely clean

Blacklist

• Enter an address or domain: spam@nervig.com or *@nervig.com.
• Mail always gets rejected, no matter what.

Useful for:

• Addresses you never want to hear from again after leaving their newsletter lists
• Domains that send spam in bulk

Scope

Both lists apply domain-wide — so to all mailboxes of your domain. If you only want to whitelist for your own mailbox, that works via a personal Sieve filter — see Personal Sieve filters in webmail.

When your own mail lands in spam

The other direction: you send a mail from your mailbox, and it lands in the recipient’s spam folder. What to do?

On the recipient’s side:

• The recipient should whitelist you (if they can).
• The recipient should mark mail in their spam folder as “not spam”.

On our side:

• We check DKIM, SPF, DMARC for your domain — all three should arrive at the recipient as “pass”. The recipient can verify this with “show mail headers” and the mxtoolbox.com tool.
• We check IP reputation. Our mail-server IPs are clean, but with very large sending volumes, reputation sometimes has to be built up first.
• If you have problems regularly, open a ticket — we analyze on the server side.

Managing the quarantine

The Mailcow quarantine (Email → Quarantine) shows you mail the server has held back. Retention is 30 days by default, then auto-deletion.

Per mail you can:

• Inspect the content (preview)
• Release: deliver to the recipient
• Discard: delete for good
• Learn the sender: add to the whitelist

Tip: skim through the quarantine once a week. That’s usually enough to catch important false positives without it turning into real work.

Reading the mail logs

In Email → Mail logs you see every mail that passed through your server:

• Timestamp
• Sender
• Recipient
• Spam score
• Action (delivered / quarantine / rejected)
• Status code

The first place to look when “mail doesn’t arrive”. If the log shows the mail marked “rejected” with a spam score of 15 — it’s gone, not in quarantine.

Frequently asked questions

Mailcow filters too aggressively, I’m losing important mail. What now? First check the quarantine — most wrongly blocked mail lands there. If the pattern repeats: whitelist the problematic senders. If the problem is global (filter set too strict), open a ticket — we can tune the server thresholds individually for your domain.

Mailcow filters too loosely, I’m getting lots of spam. What now? Look in the Junk folder — maybe a lot of spam is already there, and the filter just moved it to the wrong folder from your point of view. If the Junk folder is empty and there’s still lots of spam in the inbox: set up a personal Sieve filter with a lower spam threshold (say, score > 6 goes to Junk).

What’s the difference between Junk and quarantine?

• Junk is a normal IMAP folder in your mailbox. You see it in SOGo and in mail clients. Mail lands there at a medium spam score.
• Quarantine is a server-side area. Mail lands there at a very high spam score, before it’s placed in any mailbox at all.

How many days does mail stay in quarantine? 30 days by default. Then auto-deletion.

Why do I sometimes see mail with [SPAM] in the subject? An add-on Mailcow can optionally enable: mail with a high score gets [SPAM] prefixed to the subject but still lands in the inbox. Handy if you don’t want everything in Junk but still want to spot the suspicious mail.

Can I set different spam thresholds per mailbox? Not by default. If you need that (say an info@ mailbox that should be stricter than an internal one), open a ticket — on the server side it can be set individually.

The spam filter misses: mail with obvious spam content in the inbox. Why? Mailcow uses multiple factors — content alone often isn’t enough for a high score. If the sender has DKIM/SPF/DMARC set up correctly and no known indicators apply, even an obvious spam mail can slip through. Solution: blacklist the sender, or build your own Sieve filter (“body contains XYZ → Junk”).

What’s next

• Personal Sieve filters in webmail
• First login as domain admin in the Mailcow GUI
• Domain-wide Sieve filters