---
title: "Phishing and spam filtering"
description: "Mail that fails DMARC under a quarantine or reject policy, or arrives already marked as spam, is filed in Spam instead of your inbox, never refused."
url: "https://openemail.uk/features/spam-filter"
---

[Safety & authenticity](https://openemail.uk/features.md#safety)

# Phishing & spam filtering Disowned mail goes to Spam.

When a domain's own DMARC policy disowns a message, or an upstream check already called it spam, it lands in Spam.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[All features](https://openemail.uk/features.md)

In short

## How do spam filters catch phishing?

Phishing often forges a real company's domain. DMARC lets that domain tell receivers what to do with mail failing its checks: nothing, quarantine or reject. Spam scanners on the way add their verdict as headers.

How it works

## The domain's own policy decides

A DMARC failure counts only where the domain publishes quarantine or reject. At p=none the owner asked for no change.

## An upstream verdict is honoured

X-Spam-Status or X-Spam-Flag set to yes, or an X-Spam-Score of five or more, sends the message to Spam.

## SPF alone is not enough

Forwarded mail fails SPF legitimately. Filing every forward as spam would be worse than the spam it caught.

## What the filter reads

What a Spam verdict rests on.

p=none No change asked p=quarantine Failures filed in Spam p=reject Also filed, not refused X-Spam-Status: Yes Upstream says spam X-Spam-Flag: YES Upstream flag set X-Spam-Score: 5.0 Five or more files it

What you get

## In the product today

Filed, never refused

Caught mail waits in Spam, one Move to Inbox away.

Scanned at the door

A spam or virus verdict from the receiving servers files mail in Spam too.

Quiet on your phone

Mail the filter sends to Spam triggers no push notification.

Rules can read it

Your rules can test the spam verdict, or file mail to Spam themselves.

Good practice

## Getting the most out of it

1. 01
   
   Check Spam first
   
   When expected mail has not arrived, check Spam before asking for a resend.
2. 02
   
   Enforce your own domain
   
   Once everything you send passes DMARC, publish quarantine or reject, because p=none asks receivers to leave forgeries alone.
3. 03
   
   Block repeat senders
   
   If one sender keeps getting through, block the address or its whole domain.

Where it stands

## Good to know

Questions

## Asked often

Keep going

## Works well with

DMARC policy

A starter p=none record, printed to copy or written by a sync, never tightened for you.

Sender research & look-alike domains

Who is this, in fifty words, and is the domain a look-alike?

Written by AI

A label on the message when the words look generated rather than written.

Start

## Your domain, your mail.

Point a domain at OpenEmail and read it in a mailbox built around it. The free plan covers one domain.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[Read the reference](https://openemail.uk/docs/knowledge/safety/spam-filter.md)