Reducing incoming spam on business email

Why Is Your Enterprise Email Full of Spam?

If your enterprise email inbox receives dozens of promotional, phishing, or spam messages daily, you are not alone. According to global statistics, more than 45% of all emails sent in 2024 were spam. But the real problem becomes serious when a legitimate email from a customer or colleague mistakenly lands in the spam folder and you never see it.

The solution is not to completely disable the anti-spam filter; rather, it is to configure it precisely and intelligently. In this article, you will learn how to configure the anti-spam filter so that it both stops spam and does not miss legitimate emails. This is achieved by combining three main tools: content filters, blacklists and whitelists, and detection sensitivity settings.

Structure of a Standard Enterprise Anti-Spam System

A good anti-spam system on your mail server (such as MailEnable, hMailServer, or Zimbra) consists of several layers. Each layer has a specific role, and if you configure all of them correctly, the spam detection rate can exceed 98% without sacrificing legitimate emails.

Layer One: Sender Authentication Checks (SPF, DKIM, DMARC)

Before examining the email content, you must ensure the sender is truly who they claim to be. Three DNS records accomplish this:

• SPF (Sender Policy Framework): Specifies which servers are authorized to send emails from your domain.
• DKIM (DomainKeys Identified Mail): Verifies the digital signature of the email.
• DMARC (Domain-based Message Authentication): Determines the policy for handling invalid emails.

To check whether your domain has these records, use the following commands:

nslookup -type=TXT yourdomain.com
nslookup -type=TXT default._domainkey.yourdomain.com
nslookup -type=TXT _dmarc.yourdomain.com

If your SPF record looks like this, you are on the right track:

v=spf1 mx ip4:185.10.10.10 include:_spf.google.com ~all

Common mistake: Many system administrators use +all at the end of the SPF record, which means "anyone can send emails on behalf of our domain." This effectively renders SPF useless and blinds your anti-spam filter. Always use ~all (soft fail) or -all (hard fail).

Layer Two: Content Filtering and Scoring

After authentication, it is time to examine the content. Modern filters such as SpamAssassin assign each email a score from 0 to 10. The higher the score, the more likely it is spam. Default settings usually set the threshold at 5, but this number is not suitable for every organization.

To fine-tune in SpamAssassin, edit the local.cf file:

required_score 5.0
rewrite_header Subject [SPAM]
report_safe 0
use_bayes 1
bayes_auto_learn 1
bayes_auto_learn_threshold_nonspam 0.1
bayes_auto_learn_threshold_spam 12.0

Change the required_score value based on your needs. If you are missing important emails, increase it to 6 or 7. If you still see too much spam, decrease it to 4.

Blacklist and Whitelist: Your Secret Weapons

Blacklists and whitelists are the simplest yet most effective anti-spam tools. The problem is that most administrators only use the blacklist and forget the whitelist.

Blacklist

Add email addresses, domains, or IPs that you know send spam here. In hMailServer, you can do this via Anti-spam → Blacklist settings. Example:

spammer@example.com
example-spam-domain.com
203.0.113.25

But be careful: the blacklist is only for definitive cases. If you mistakenly block a large domain like Gmail, you will lose a significant portion of legitimate emails.

Whitelist

This list is more important than the blacklist. Add senders you know are legitimate so they are never filtered. In MailEnable, use the path SMTP → Filters → Whitelist:

client@important-customer.com
partner-domain.com
192.168.1.0/24

Practical tip: At minimum, add the domains of your key business partners, your own subdomains, and cloud services you receive emails from (such as notif@aws.amazon.com) to the whitelist. This alone can eliminate 30-40% of detection errors.

Adjusting Sensitivity Without Losing Legitimate Emails

The most important part of the job is finding the balance between "detecting spam" and "preserving legitimate emails." This is done through three methods:

1. Using the Quarantine Folder Instead of Direct Deletion

Never delete suspicious emails directly. Instead, route them to the quarantine folder and send a daily report to the system administrator. In Zimbra, this is done with the following commands:

zmprov mcf zimbraSpamQuarantineUser admin@yourdomain.com
zmprov mcf zimbraSpamQuarantineEnabled TRUE

With this, if an important email is mistakenly filtered, it remains in quarantine for up to 30 days and can be recovered.

2. Adjusting Bayesian Learning Rates

Bayesian filters improve by learning from your emails. In SpamAssassin, you need to "teach" the filter what is spam and what is not. This is done through manual training:

sa-learn --spam /path/to/spam-folder/*.eml
sa-learn --ham /path/to/ham-folder/*.eml

Run these commands once a week. After 2-3 weeks, detection accuracy will noticeably improve.

3. Adjusting the Threshold Based on Email Volume

If your organization receives fewer than 50 emails per day, set the threshold to 7 to ensure no legitimate email is missed. If you receive more than 500 emails per day, a threshold of 4 is more reasonable. The table below provides general guidance:

• Fewer than 50 emails per day: Threshold 6.5 to 7.5
• 50 to 200 emails per day: Threshold 5.5 to 6.5
• More than 200 emails per day: Threshold 4.5 to 5.5

Common Mistakes to Avoid

In years of supporting enterprise mail servers, I have repeatedly seen several mistakes that cause legitimate emails to be lost:

Mistake One: Blocking Entire Large Domains

When you see a spam email from Gmail, you might be tempted to block all of gmail.com. This is disastrous. Instead, only block the specific email address or the sender's IP.

Mistake Two: Completely Disabling the Anti-Spam Filter

Some administrators, after losing a few legitimate emails, turn off the entire filter. This fills the inbox with spam and ultimately causes you to lose legitimate emails as well. Instead of disabling it, increase the threshold and enable quarantine.

Mistake Three: Ignoring Reports

Most anti-spam systems provide detailed reports of filtered emails. Review these reports weekly. If you notice a specific domain is repeatedly filtered, add it to the whitelist or investigate why it is being filtered.

Summary and Practical Steps

Reducing incoming spam without losing legitimate emails is a gradual process. Implement these steps in order:

1. Check and correct the SPF, DKIM, and DMARC records for your domain.
2. Create a whitelist of business partner domains and important services.
3. Enable quarantine and set the threshold to 5.5.
4. Train the Bayesian filter with real emails and spam.
5. Review filter reports weekly and adjust settings accordingly.

If your enterprise email infrastructure requires a fundamental overhaul, ServerNet's enterprise email service can relieve you of this concern with professional anti-spam configurations. However, in any case, the principles discussed in this article can be implemented on any mail server.

By following these steps, you will see an 80-90% reduction in spam within two weeks, while no longer worrying about losing important emails. The key point is to view the anti-spam filter as a dynamic tool that needs regular adjustment and updates, not a one-time configuration.