Skip to main content
Inbound checks every received email for spam, phishing, fraud, malware and impersonation. Emails that cross your account’s threshold are marked as junk. Junk mail is never dropped:
  • Webhooks still receive it, with email.spam.isJunk: true. See Webhook Structure.
  • IMAP shows it in the Junk folder instead of INBOX and the scope folders. See IMAP Behavior.
  • The mailbox API lists it under folder=junk, and the email API returns spam.is_junk.

​
Filter levels

Set the level in the Mailboxes & SMTP dashboard or with PUT /api/e2/spam-filter. It applies to the whole account and to emails received after the change. Each email gets a level from 0 (none) to 4 (clear) for spam, phishing, fraud, malware and impersonation. Failed authentication (for example a DMARC failure) can raise a level, but standard and lenient only act when the classifier itself backs the level:
  • For spam, phishing and fraud, the classifier gives a probability for each level. “Likely” means at least a 70% chance of that level or higher.
  • For malware and impersonation, the classifier says how likely the label is. “Likely” means at least an 80% chance.
Prompt injection (text aimed at an AI reading the email) is checked too, but never marks an email as junk by itself. Unless the level is off, an email that fails the receiving server’s spam check or virus scan is also marked as junk. A failed virus scan counts as clear malware.

​
Guard rules

Guard rules take precedence over the filter level:
  • The junk action marks matching emails as junk without blocking them.
  • The allow action marks matching emails as not junk, even if the filter would flag them.
  • The block action still blocks delivery entirely.

​
Correcting a verdict

Moving a message between INBOX and Junk in an email client, or setting isJunk with PATCH /api/e2/mailboxes/{id}/messages/{messageId} or is_junk with PATCH /api/e2/emails/{id}, records your decision for the email across the account. Automatic verdicts never override a decision you made. The webhook and API report why an email was marked: classifier, ses_spam, guard_rule or user.