Tune the spam threshold

The threshold is the score at which the filter stops trusting a message. Move it and you change how much mail ends up in quarantine, in both directions at once. Stricter filtering holds more good mail, and looser filtering delivers more of the bad, so the setting is a trade rather than an improvement.

The two thresholds on the settings page

The filter settings page carries two sliders and a field beside each one. Quarantine threshold is the score above which a message is held, and it is set at 0.9 out of the box. Beneficial to train threshold is the lower score at which a message is worth training on rather than simply delivering, and it is set at 0.1.

The two work together in a way that surprises people. Raising the quarantine threshold delivers more mail and puts fewer messages in front of you to judge. It also means the messages you do see are the worst of them, which is fine until a good sender scores just under the line and disappears quietly.

The Filter settings page. Quarantine enabled is ticked. Quarantine threshold is a slider with a field reading 0.9, and Beneficial to train threshold is a slider with a field reading 0.1. Sender checks lists SPF Sender Policy Framework, DKIM Domain Keys Identified Mail and DMARC Domain-based Message Authentication, Reporting and Conformance, all three ticked. Below them are unticked options for Skip maximum line length check, Block messages from newly registered domains and Block messages from sending email servers without a valid PTR record, then a Beneficial to train notation field. — The settings page. The two sliders are the trade, and the sender checks under them decide how much weight the filter puts on authentication.

Change one thing, then wait

Move the quarantine threshold in small steps, and give each step a few days. A change of a tenth or two is enough to see the effect in the log search, and anything larger tells you nothing because you cannot attribute what happened.

Watch two numbers while you do it. The count of held messages should do what you intended. The count of messages you release as false positives should not rise, and if it does, the threshold has gone the wrong way for the mail your domain actually receives.

If a specific sender is being caught, resist the urge to loosen the threshold for everyone. Whitelisting a sender fixes one address without lowering the fence around the rest.

The sender checks below the sliders

Three checkboxes let the filter act on the results of SPF, DKIM and DMARC. All three are on, and they should stay on unless you have a specific reason and know what it is. Turning them off means a message that fails authentication is judged on its content alone, which is how a forged sender gets a fair hearing.

The options under them are the ones worth thinking about. Block messages from newly registered domains catches a large share of short-lived spam campaigns, and it also catches the new domain a small supplier has just bought. Block messages from sending servers without a valid PTR record stops a lot of badly run bulk mail and a few legitimate senders who never set their DNS up properly. Both are reasonable for a domain that receives ordinary business mail, and both are worth trying one at a time so you can tell which one cost you a message.

Quarantine enabled is the switch that keeps held mail rather than rejecting it. Leave it on. With it off, the filter delivers everything to your server, including the messages it was sure about, which is the one setting on this page that removes the safety net rather than adjusting it.

When the settings are not the problem

A domain where good mail keeps disappearing is often not mis-tuned. A missing SPF record, a DKIM key that was never published, or mail that arrives through a forwarder will fail authentication and score badly however the threshold is set. Business Email publishes SPF, DKIM and DMARC for its mailboxes, and pointing your MX records at the filter covers the change that puts mail through it in the first place.