Chapter 07 Mail Transport & Defense Admin: #pSpam

SpamGuard, Smart Greylisting, DNSBL, FTRL-ML & ClamAV Antivirus

SharpMailserver's inbound defense combines protocol-level checks (SPF, DKIM, DMARC, FCrDNS, DNSBL, Smart Greylisting) with MIME heuristics, an online FTRL machine-learning model (trained automatically when users move mail into or out of Junk), and optional streaming ClamAV antivirus.

Operational Tip & Architecture Note

Zero silent mail loss: messages scoring between JunkThreshold (4.5) and RejectThreshold (9.0) are never dropped silently; they land safely in the user's Junk folder with detailed X-Spam-Status headers. Test any sample live in the Spam Analyzer (#pSpam).

Inbound Pipeline Scoring & Action Tiers

Users train the per-tenant FTRL classifier naturally whenever they move messages into or out of 'Junk'.

Reference / Configuration

Score < 4.5                  -> Zustellung in Posteingang (Ham)
4.5 <= Score < 9.0           -> Zustellung in Ordner "Spam / Junk" (kein Datenverlust)
Score >= 9.0                 -> Direkte SMTP-Ablehnung mit 550 5.7.1
ClamAV Signatur-Treffer      -> Sofortige SMTP-Ablehnung mit 554 5.7.0 Malware rejected

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`JunkThreshold & RejectThreshold (#pSpam)`	Scores >= JunkThreshold route to the Junk folder; scores >= RejectThreshold trigger an immediate SMTP 550 5.7.1 rejection.	`Junk: 4.5 · Reject: 9.0`	4.5 / 9.0 provides optimal balance. Avoid lowering RejectThreshold below 7.5 so poorly formatted legitimate newsletters go to Junk rather than bouncing.
`SubjectPrefix ([SPAM])`	Optionally prepends a visible tag such as [SPAM] to the Subject header of messages classified as Junk.	`Deaktiviert (Ordner-Routing)`	Leave off when using Webmail, IMAP, or Mobile Push since Junk folder routing is cleaner and keeps the original subject intact if unmarked.
`Smart Greylisting (GreylistingEnabled)`	Issues a polite one-time 451 temporary deferral for unseen (IP /24 or /64 prefix, MAIL FROM, RCPT TO) triplets; skips SPF/DKIM-aligned senders.	`Aktiv · 240 s Wartezeit`	Keep enabled! Blocks >85% of fire-and-forget botnets before DATA transfer while SPF/DKIM-verified senders bypass the delay automatically.
`DNSBL-Zonen & DnsblScore`	Queries real-time IP blocklists and adds DnsblScore to the composite spam score rather than blindly dropping on a single list hit.	`zen.spamhaus.org, bl.spamcop.net (3.5)`	Important for Spamhaus: ensure your OS uses a local recursive DNS resolver (Unbound / Windows DNS / pfSense), NOT public resolvers like 8.8.8.8 or 1.1.1.1!
`ClamAV Antivirus (TCP INSTREAM)`	Streams inbound MIME payloads over TCP INSTREAM to a local or LAN clamd daemon and rejects malware at SMTP time with 554 5.7.0.	`Deaktiviert · 127.0.0.1:3310`	When running clamd (Docker sidecar or Linux/Windows daemon), verify connectivity using the 1-click PING + EICAR stream self-test in #pSpam.