Which methods are used for filtering?

The filtering methods and the EuropeanMX system have been specially designed to avoid false positives messages. To avoid errors due to a single classification, a large amount of different checks are performed. Basically, the exam can be divided into 2 levels: the SMTP level and the DATA level. Thanks to the combination of many different filtering systems and compliance with RFC policies, which are described how to handle a single connection, we can ensure that a message never disappears. The sender is always informed by his mail server if a message has been rejected or blocked and moved to quarantine.

SMTP level

As often as possible we try not to block a message after the "rcpt to:"SMTP command. This ensures that all connections to the recipient domain are properly stored on the protocol server. This can help to keep track of the recipient account connections.

Before the DATA level is reached, various other things are checked (e.g. whether the connection standards according to RFC have been complied with, the server is not entered on any internal and/or external blacklist, etc.). If the connection is established from an unknown server that does not yet have a good reputation in our system, the message may be temporarily rejected with a 4xx code. In this case, the sending server will put the message in the queue and try to deliver it again. After 10 minutes, the connection to our network is accepted and the internal whitelist is adjusted so that delays can be avoided in the future. This concept is commonly known as "greylisting". However, in contrast to traditional greylisting, our concept is much more sophisticated. All server nodes are synchronized with each other and only connections that are unknown to the EuropeanMX network are blocked. Therefore, delays due to greylisting within a filter cluster are very unusual and usually do not cause any problems for recipients. You can find detailed information on greylisting with EurpopeanMX in our FAQ article "What does greylisting mean and how is it handled at EuropeanMX?".

If the connection is established from a spam source, it could happen that the message is temporarily rejected with a 4xx code. In this way, even if the server has been mislisted as a spam source (e. g. on an external blacklist) or the spam problem has been solved on the sent server, the message is not lost and is forwarded to the final recipient. This does not apply to connections originating from a known source that is used exclusively for sending spam or where the behavior does not correspond to the RFC standard. In this case, the connection may be permanently rejected with a 5xx error. If this should ever happen to a legitimate sender, the sender will always receive a bounce notification from his mail server. This problem only occurs if there are serious problems with the sending server. This issue must then be investigated on the sender side.

DATA level

Once the DATA level has been reached, the content of the message is examined based on a combination of advanced statistical filter technologies, spam fingerprint databases, virus, phishing and spyware databases. If a message is recognized as spam, it is either temporarily (4xx error) or permanently rejected (5xx error), depending on the score achieved. A message that is permanently rejected is moved to quarantine by the filter and can be released from there (except in the case of a virus). If a legitimate message is permanently blocked, the sender is always informed by the sending mail server that the message could not be delivered.

Graphic illustration