What inbound email protection adds to ordinary spam filtering
Inbound email protection is the set of checks a message passes before it reaches anyone's inbox: who really sent it, whether the sender is known for abuse, what the links and attachments contain, and how your own team has judged similar mail. Every mailbox needs some filtering. A stronger inbound layer matters because phishing email is how most account takeovers, payment frauds and malware infections begin. This article explains what each check does and what filtering cannot do on its own.
Why inbound protection matters
A business inbox receives mail from strangers all day: customers, suppliers, couriers, banks and, among them, criminals. The criminal messages are built to look like the others. A fake invoice with changed bank details, a courier notice with a link to a lookalike login page, a "voicemail" attachment that installs malware.
The UK National Cyber Security Centre (NCSC) describes defence against phishing in layers, and the first layer is making it hard for these messages to reach people at all. Every phishing email that is stopped at the server is one nobody has to recognise.
Checking who really sent it
The first question for any message is whether the sender is who they claim to be. Domains publish SPF, DKIM and DMARC records that say which servers may send for them and how to treat mail that fails.
Inbound protection applies those checks to mail arriving at your domain. A message that claims to be from your bank, but fails the bank's own DMARC policy, is treated as forged. The US cybersecurity agency CISA and the NCSC both recommend honouring senders' DMARC policies on incoming mail.
Good filtering applies this with judgement. Forwarded mail and mailing lists can break the checks for genuine messages, and the DMARC standard itself warns receivers not to reject on that basis alone. A scoring filter weighs the failure with other evidence, so real mail is not lost.
Stopping known bad senders at the door
Much spam comes from machines that are already known for it: compromised computers, servers rented for abuse, addresses that should never send mail directly. Blocklists track them. A filter can check the connecting server against a blocklist and refuse the message before it is even accepted.
Greylisting adds another step. A server that has never written to you before is asked to try again a few minutes later. Legitimate mail servers retry. Many spam tools do not. The cost is that the first message from a new correspondent can arrive a little late.
Looking inside the message
A message from an unknown sender that passes the identity checks still needs a closer look.
- Content scoring. The filter tests the headers and body against many rules and adds up a score. Above one score the message is marked as spam; above a higher one it is refused.
- Links. Links are checked against lists of known phishing and malicious addresses.
- Attachments. Files are scanned for malware, including inside ZIP and other archives, Office documents and PDFs.
- Risky file types. Some attachment types are blocked outright, because they are used far more often to deliver malware than for honest work.
A filter that learns from your team
Rules catch the obvious. The rest is learned. A statistical filter studies the mail your users mark as spam and the mail they mark as not spam, and gets better at telling the two apart for the kind of mail your business receives. It needs both kinds of example to learn anything.
That is why moving a missed spam message into the Spam folder, and moving a wrongly caught message back out, is worth the click. Each decision teaches the filter.
Held, not lost
A filter that throws away mail it is unsure about will, sooner or later, throw away an order or a quote. Good inbound protection tags or holds uncertain messages so you can still find them, and refuses outright only what it is confident about. When a real message is caught, release it and mark it as not spam. When a fake gets through, report it.
What filtering cannot do
No filter stops every phishing email. Criminals test their messages against common filters, and a brand-new lookalike domain with clean records can pass every identity check. The NCSC and CISA both put filtering alongside other layers:
- People who report. Make it easy and blame-free to report a suspicious message. Our help article on identifying spam and phishing lists the signs.
- Two-factor authentication, so a stolen password alone does not open an account.
- Updates and limited admin rights, so a malicious attachment that does get opened can do less.
- A habit of checking payment changes by phone, using a number you already have.
Email Security from Noiz
Noiz shared hosting email already comes with webmail and spam filtering.
The Email Security add-on adds a stronger layer for a domain hosted with Noiz:
- Advanced spam and virus filtering.
- SPF, DKIM and DMARC kept configured, so your own mail is harder to forge.
- DNSSEC on your domain's DNS zone.
- A backup of your email, which plan backups do not cover.
- One price per hosted domain.
For an organisation that wants its mail on a server of its own, Private Email includes a learning spam filter, virus scanning and a quarantine for held messages. Add Email Security to a hosted domain from the client area, or open a ticket to ask which option fits your mail.
Sources
Checked 19 October 2026.
Guidance
- NCSC, Phishing attacks: defending your organisation
- CISA, NSA, FBI and MS-ISAC, Phishing guidance: stopping the attack cycle at phase one (PDF)
Standards
Open-source filtering documentation
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
