Engineering Glossary · Mailbox Ops
Spam Filtering: Where It Runs Decides What It Can Do
A filter running inside your mail client has already cost you the bandwidth, the disk and the delivery; only one of the three layers can say no before any of that happens.
The short answer
A spam filter scores arriving mail against content patterns, sender reputation and authentication results, then routes anything above a threshold away from the inbox.
The layer it runs at is the design decision that matters. Filtering at MX level makes the judgement during the SMTP conversation, before your server has agreed to accept the message, so junk costs you nothing and the sender of a false positive gets an immediate rejection they can act on. Server-side filtering sorts what has already been accepted, which means you have paid for it in disk and inodes. Client-side rules apply to one device only. Each layer can do strictly less than the one above it.
By the HostingFast team · Reviewed 12 August 2026
100+
Terms in the glossary
2 min
Average read time
Plain
English throughout
24/7
Humans if you get stuck
Filtering happens at three levels. At MX level a message is judged before your server has agreed to take it, and can be turned away completely. Filters running on the server sort whatever made it through. Rules inside your own mail client clean up the remainder, device by device.
There is a standing trade-off underneath all of it: catch every piece of junk, or never catch a message that mattered. Quarantine digests exist so the uncertain middle gets a human glance instead of being deleted quietly.
Three layers, three different powers
MX-level filtering answers during the SMTP transaction. A rejected message is never stored, never counted against a quota and never allocated an inode, and a legitimate sender caught by mistake receives a bounce telling them so — which is a far better failure than silence. This is what the mail filtering add-on provides, and it is the only layer that can decline a message outright.
Server-side filtering runs after acceptance. It can move, tag or delete, but the message already exists on disk, so a heavy junk flow still consumes storage and file count. Client-side rules are weaker again: they run on one machine, they do not apply to the phone, and they cannot help anyone else on the domain.
Read the score before you change the threshold
Filtered mail carries its reasoning in the headers. Look for X-Spam-Score and X-Spam-Status on a message that was caught, and you get the numeric score alongside the individual rules that contributed to it. That turns 'the filter is too aggressive' into a specific list of rules and a specific number, which is something you can actually adjust against.
The same headers on a message that got through are just as useful. A piece of obvious junk scoring just below your threshold tells you exactly how far to move it, and by how little. Guessing at the threshold and moving it in whole points is how a filter oscillates between letting everything through and quarantining the accountant.
False positives are the expensive error
Junk in the inbox costs seconds. A quotation request in quarantine costs the job. So the tuning target is not the catch rate, it is the release rate: how many genuine messages you pull out of quarantine in a week. If that number is above zero and stable, the threshold is too tight for your traffic mix.
Run the quarantine digest and read it for a fortnight before changing anything. Two weeks of evidence beats an afternoon of instinct, and it also catches the seasonal pattern — the month-end supplier statement, the annual renewal notice — that a three-day sample never sees.
Where this lands on HostingFast
Spam and virus scanning runs on every mailbox as standard, and the mail filtering add-on moves the judgement out to MX level for anyone whose junk volume justifies it. Backups run daily on every plan, and restoring a file or a database is a single click in the panel, not a support ticket.
Read next: Phishing for what the filter is actually protecting you from, plus SPF, DKIM and DMARC — the authentication results the score is partly built on.
A hundred terms, each with the mechanism
Every entry here started life as a support ticket. Rather than explain the same term for the two hundredth time, we wrote it down properly — with the header names, the thresholds and the evidence to gather first.
Support is a human being at any hour, and the scope covers the awkward practical questions other hosts bounce straight back.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Layers ranked by power
Where the same job can happen at three places in a stack, the entry says what each layer can and cannot do.
Headers as evidence
X-Spam-Score and X-Spam-Status turn a complaint into a number and a rule list you can adjust against.
The right metric named
Catch rate is the vanity figure; release rate is the one that tells you whether the threshold is wrong.
Evidence windows stated
A fortnight, not an afternoon, because seasonal senders never appear in a three-day sample.
Wired to its neighbours
Spam Filter runs into Phishing, SPF and DMARC — the authentication signals feeding the score.
This term, landed
Filtering defined by layer, its headers read and its threshold tuned on evidence — enough to stop guessing.
Quick Start
From order to online
- 1
Establish which layer is judging
MX-level, server-side or client rules. The answer determines what a change can possibly achieve, and rules out two thirds of the settings screens.
- 2
Pull the score off a caught message
X-Spam-Score and X-Spam-Status give you the number and the contributing rules. Now the threshold has a target rather than a direction.
- 3
Watch the release rate for a fortnight
Count genuine messages pulled out of quarantine per week. Above zero and stable means too tight; adjust in small steps and measure again.
Built In
Loaded onto every plan
- Spam and virus scanning on every mailbox by default
- MX-level filtering available through the mail filtering add-on
- Mailboxes on your own domain, included with the plan
- NVMe SSD storage on every tier, not only the expensive ones
- Daily backups with self-service restores you run yourself from the panel
- DDoS filtering absorbed out at the network edge
- Real SSH, plus Git and Composer, on the developer-focused plans
- LiteSpeed caching built into the server rather than bolted on by plugin
- Human support on duty every hour of every day
- Year one of your domain free when you order annually
Frequently Asked
What people ask us most often
What do the X-Spam headers on a message actually tell me?
X-Spam-Score gives the numeric total and X-Spam-Status usually itemises the rules that produced it. Read them on a message that was wrongly caught and you get a specific score and a specific rule to argue with. Read them on junk that got through and you learn precisely how far your threshold is off, which is the difference between tuning and guessing.
Should filtering happen at MX level or on the server?
At MX level if the volume justifies it, because that is the only layer that can decline a message during the SMTP conversation — no storage consumed, no inode used, and a real rejection notice for a sender caught by mistake. Server-side filtering has already accepted the message and can only sort it afterwards. Client rules are weaker again, since they cover one device.
What evidence should a threshold change be based on?
A fortnight of quarantine, not an afternoon of frustration. Count the genuine messages you release per week and treat that as the metric; a stable non-zero release rate means the threshold is too tight for your traffic. Two weeks also catches the month-end statement and the annual renewal notice, which never appear in a three-day sample.
Can I switch auto-renewal off myself?
Yes — it is a toggle in your account, with no phone call and no retention conversation involved. Payment is by credit or debit card through a secure checkout, renewals bill at the same rate as the original order, and every invoice stays available in your client area.
Keep reading
Phishing
The attack the filter exists to intercept, and what gets through when authentication is missing.
DMARC
The policy layer whose verdict feeds the score, and the reports that show who is forging you.
How to Stop Your Email Going to Spam
Fixing deliverability at the sending end, which is where most spam-folder complaints actually originate.
Dedicated Cloud
Reserved resources plus cloud flexibility — the next gear up from a VPS.
Domain Names
Find, register and transfer domains — first year free with annual hosting.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Filter it before it costs you disk.
Spam and virus scanning on every mailbox as standard, MX-level filtering when you need it, and NVMe under the whole platform.
View Dedicated Cloud plans