How to Configure Spamfilter Policies for a Mailbox in ISPConfig

This guide shows you how to choose a spamfilter policy for an individual mailbox in the ISPConfig control panel, and explains what the built-in policy levels and their tag and kill scores actually do. A mailbox is sometimes called an email account, and a spamfilter policy is sometimes called a spamfilter level: it is the set of rules that decides how aggressively incoming mail for that address is checked for spam and viruses. By the end of this guide you will know how to pick the right policy for each mailbox, how mailbox settings interact with the domain-wide setting, and how to read the scores that decide whether a message is tagged as spam or blocked outright.

Last reviewed: 27 July 2026, against ISPConfig 3.3.1p1, the release Noiz runs. The field names, policy names and default scores below were checked against that release. This guide complements, and does not replace, the official ISPConfig documentation linked below. ISPConfig evolves between releases, so if a screen differs from this guide, check those links.

Official Documentation Reference

• ISPConfig official documentation index, home of the ISPConfig 3 manual that this article is based on
• Howtoforge forum: Clarification of Spam Filter Policies in ISPConfig 3, background on the default policy levels and score thresholds
• ISPConfig 3.3.1p1 source: spamfilter policy interface text, the exact field labels used by the current policy editor

Prerequisites

• You can log in to the ISPConfig control panel.
• At least one mailbox already exists on your account. If not, first create an email mailbox in ISPConfig.
• Your hosting plan includes the Email module. If you cannot see it after logging in, your plan may not include email hosting through ISPConfig.

How Spamfilter Policies Work

Every message that arrives for a filtered mailbox is scanned and given a spam score. The higher the score, the more likely the message is spam. A spamfilter policy is a named set of thresholds and behaviours that tells the mail system what to do at each score: add warning headers, tag the subject line, or refuse the message entirely.

ISPConfig lets you apply a policy at two levels:

• Per email domain: the Spamfilter field on the domain under Email > Email Accounts > Domain sets the default for every mailbox on that domain.
• Per mailbox: the Spamfilter field on the individual mailbox overrides the domain default for that one address.

The mailbox dropdown includes the option - Inherit domain setting -, which is the default for new mailboxes. While it is selected, the mailbox simply follows whatever policy the domain uses. As soon as you pick a named policy on the mailbox, that choice wins for this mailbox, regardless of what the domain is set to. That holds even when the domain's Spamfilter field is - not enabled -: a policy chosen on the mailbox still applies.

Select a Spamfilter Policy for a Mailbox

Open the Mailbox Settings

1. Log in to the ISPConfig control panel.
2. Click Email in the top menu.
3. In the left-hand menu, under Email Accounts, click Email Mailbox. A list of your mailboxes appears.
4. Click the email address of the mailbox you want to change, for example [email protected] (replace yourdomain.com with your own domain).

Choose a Policy and Save

1. On the Mailbox tab, find the Spamfilter dropdown.
2. Select the policy you want for this mailbox. - Inherit domain setting - is always first; the named policies follow in alphabetical order, so the standard list reads:
   • - Inherit domain setting -
   • Non-paying
   • Normal
   • Permissive
   • Trigger happy
   • Uncensored
   • Wants all spam
   • Wants viruses
   For almost every mailbox, Normal is the right choice. The next section explains what each level means.
3. Click Save.

ISPConfig applies configuration changes in the background, so allow a minute or two before testing. The new policy affects mail that arrives after the change; it does not rescan messages already in the mailbox.

What the Policy Levels Mean

The seven built-in policies are working examples inherited from the underlying mail filter, and their names describe the kind of recipient they were written for. Two of them switch filtering off, by different means; the rest differ mainly in where the score thresholds sit. Listed here roughly from least filtering to most:

• Uncensored: mail is still scanned, but the results of the spam, virus, banned file and bad header checks are all ignored and everything is delivered. Selecting this level effectively switches the spamfilter off for the mailbox. Use it only for troubleshooting or for special-purpose addresses that must receive absolutely everything.
• Non-paying: switches filtering off the other way round, by skipping the spam, virus and banned file checks entirely rather than scanning and then ignoring the verdict. It is an example policy for accounts not entitled to a filtering service, and it is rarely the right choice on a hosting account. Prefer Normal unless the Noiz support team advises otherwise.
• Wants all spam: spam checks run and spam is still tagged, but no spam is ever blocked; all of it is delivered. Virus mail is still blocked. Useful for an abuse or postmaster address that needs to see the spam other people are sent.
• Wants viruses: the mirror image. Virus results are ignored, so messages carrying malware are delivered, while spam is filtered and blocked as usual. Not recommended for normal mailboxes.
• Permissive: filtering is active but the score thresholds are set high, so only very obvious spam is affected. Choose this if legitimate mail is being wrongly flagged under Normal.
• Normal: the balanced default. Suspicious mail gets informational headers, likely spam is tagged in the subject line and filed to Junk, and outright blocking is reserved for extreme scores. This is the recommended level for everyday mailboxes.
• Trigger happy: the thresholds are set low and the blocking threshold sits level with the tagging one, so the filter fires early, catches more spam and refuses it rather than tagging it. That carries a real risk of losing legitimate mail. Choose it only for addresses drowning in spam.

Understanding Tag and Kill Scores

Each policy is defined by a small set of score thresholds. You can view them under Email > Spamfilter > Policy: click a policy name to open it. Whether you can see or edit this section depends on the limits of your hosting plan, and that is fine, because you only need the mailbox dropdown for day-to-day use.

The classic thresholds, found on the Tag-Level section of the policy form, are:

• SPAM tag level: at or above this score, the system adds informational spam headers to the message (visible in the message source, for example X-Spam-Score). The message is still delivered normally. ISPConfig ships Normal with this set to 1.
• SPAM tag2 level: at or above this score, the message is formally classed as spam. It receives spam-detected headers, and if SPAM modifies subject is enabled, the SPAM subject tag2 text is added to the subject line. Those spam-detected headers are also what the Junk folder rule matches on, so this threshold is what decides whether a message is filed as spam. Normal ships with tag2 at 4.5 and a subject tag2 of ***SPAM***.
• SPAM kill level: at or above this score, the system takes evasive action and the message is blocked rather than delivered. This value must be equal to or higher than the tag2 level. Normal ships with the kill level at 50, far above its tag2 level, so under the shipped Normal policy spam is tagged and delivered, not refused. Where a policy sets the kill level equal to its tag2 level, as Trigger happy does, everything that reaches tag2 is blocked instead, and a subject tag serves no purpose there because nothing tagged is delivered.

The policy form also carries a second, simpler set of fields covering the same ground, used where the server runs the newer filtering engine: SPAM tag level (the score at which mail is tagged), SPAM tag method (whether tagging rewrites the subject line or only adds a header) and SPAM reject level (the score at which mail is refused, equivalent to the kill level), alongside Use greylisting and a Greylisting level, which temporarily defers borderline messages so that legitimate mail servers retry and most spam senders give up. Only one of the two sets is in force on any given server, and the scores in each are set independently, so do not assume a change to one takes effect. If you are unsure which set applies to your mailbox, ask the Noiz support team.

A note of caution: policies are shared. Every mailbox and domain set to Normal uses the same Normal record, so editing its scores changes filtering for all of them at once. If your plan allows it, create a new policy with Add Policy record and assign that to the specific mailbox instead of editing a built-in level.

Send Tagged Spam to the Junk Folder

Selecting a policy decides how spam is scored; a separate mailbox setting decides where tagged spam ends up. To have spam filed automatically:

1. Open the mailbox as described above and go to its Mail Filter tab.
2. Set Move Spam Emails to Junk folder to Move first, before custom filters., which is the default for new mailboxes.
3. Click Save.

The other two choices are Move last, after custom filters., which gives your own filter rules the first chance to claim the message, and Do not move Spam Emails to Junk folder., which leaves tagged spam in the inbox. The rule matches the spam-detected headers added at the tag2 level, so it fires only once a message crosses that threshold, and only while the spamfilter is active for the mailbox, meaning a policy other than Uncensored applies, either inherited from the domain or set on the mailbox itself. The Junk folder is only visible when you collect mail over IMAP; POP3 downloads the inbox only, so POP3 users will not see the Junk folder in their mail program.

Troubleshooting

• Too much spam is still reaching the inbox: confirm the mailbox is not set to Uncensored, Non-paying or Wants all spam, the three levels that let spam through, and that a policy is actually active (if the mailbox is set to - Inherit domain setting -, check the domain's Spamfilter field is not - not enabled -). Then try Trigger happy and set Move Spam Emails to Junk folder to one of the two move options.
• Legitimate mail is being tagged or lost: switch the mailbox to Permissive, or add the sender under Email > Spamfilter > Whitelist if that section is available on your plan. Under the shipped Normal policy spam is tagged and delivered rather than refused, so check the Junk folder and look for ***SPAM*** in the subject line before assuming a message never arrived. Trigger happy does refuse mail outright, so if a mailbox is set to that level, expect genuine losses rather than tagged copies.
• The policy change appears to have no effect: allow a minute or two for ISPConfig to apply the change, then send a fresh test message from an external address. Also check for a mailbox-level policy overriding the domain setting, or the reverse.
• The Spamfilter dropdown or the Spamfilter section is missing: the email limits on your hosting plan control what you can see. Open a support ticket with the Noiz support team to confirm what your plan includes.
• Tagged spam is not moving to the Junk folder: make sure Move Spam Emails to Junk folder on the Mail Filter tab is not set to Do not move Spam Emails to Junk folder., and that you are accessing the mailbox over IMAP rather than POP3.

If you get stuck at any point, open a support ticket with the Noiz support team and include the mailbox address, the spamfilter policy you selected, and, for filtering problems, the full headers of an example message that was handled incorrectly.