How an Email is Processed in Current SmarterMail Builds

SmarterMail > Server Configuration and Management
NOTE: This article applies to any current SmarterMail Build. For an article relating to previous versions of SmarterMail (I.e., 16.x or earlier), please see this article: How an Email Messages is Processed by SmarterMail.

SmarterMail processes each message in two stages. Understanding where a message is in the process makes it easier to troubleshoot delivery, spam handling, and routing issues.

  1. SMTP session: Checks performed while the sending server is still connected. These checks can reject a message before SmarterMail accepts it, so SmarterMail does not need to generate a non-delivery report.
  2. Spool processing: After SmarterMail accepts the message and writes it to disk, it performs the configured antivirus, antispam, archiving, routing, content-filtering, and delivery steps.
A visual representation of the information below is available for download: The SmarterMail Decision Tree. 

The add-ons listed below, such as Message Sniffer and Cyren, run only when they are licensed and enabled. Command-line checks and other spam checks also run only when enabled in the server settings.

Phase 1: The SMTP session

When a remote server or mail client connects to SmarterMail, the following checks run in order. If a check fails, SmarterMail ends the transaction with the appropriate SMTP response code.

1. Connection acceptance

  • Whitelist and incoming gateway bypass: Connections from permanently whitelisted IP addresses or configured incoming gateways skip the remaining connection checks.
  • IP blacklist: Connections from blacklisted IP addresses are rejected.
  • Abuse-detection (IDS) rules: IP addresses currently blocked for denial-of-service activity, password brute-force attempts, or email-harvesting behavior are rejected.
  • Honeypot: If the Reject Listed IPs honeypot option is enabled, IP addresses previously identified by the honeypot are rejected.

2. HELO / EHLO

SmarterMail compares the HELO/EHLO domain with the SMTP block list. A match puts the session in a soft-block state: the server treats every recipient and authentication attempt as invalid without revealing that the session is blocked.

3. MAIL FROM

  • Session limits: SmarterMail enforces the maximum messages per session and message size, using the SMTP SIZE parameter.
  • Sender validation: Local senders must belong to an existing, enabled domain. Senders on the SMTP block list are rejected.
  • Authentication requirements: If the domain requires SMTP authentication, unauthenticated sessions are rejected. When Require Auth Match is enabled, the From address, and optionally the message-header From or Sender address, must match the authenticated user or an authorized alias or delegation.
  • Early spam checks: For unauthenticated, non-whitelisted senders, SmarterMail runs the checks that do not require the message body: reverse DNS (rDNS), SPF, and any RBLs enabled for Incoming SMTP Blocking. It checks the null sender after receiving the message headers; delivery-status and read-receipt reports are exempt by default because they require a null sender. If the combined spam weight reaches the SMTP Blocking threshold, SmarterMail rejects the sender with a 554 response and does not accept the message.

4. RCPT TO

  • Recipient limits: SmarterMail enforces the maximum recipients per message at the system or domain level.
  • Local recipient validation: The recipient domain must exist and be enabled. The mailbox must exist, unless a catch-all is configured, and must be enabled and allowed to receive mail. SmarterMail also enforces mailbox and domain size limits, per-domain maximum message sizes, and bounce throttling.
  • Relay control: SmarterMail accepts nonlocal recipients only when the session is authenticated, the IP address is permitted to relay, or a smart host or gateway accepts mail for that domain. Otherwise, the RCPT TO command is rejected with Relay is not allowed.
  • Greylisting: When greylisting applies, SmarterMail records the IP address, sender, and recipient. It does not apply to authenticated senders, whitelisted IPs, trusted senders, or users and domains configured to bypass greylisting. New combinations receive a 451 Greylisted, please try again response at the DATA command, and the sending server is expected to retry after the greylist period.

5. DATA

  • Size and loop protection: While the message is written to disk, SmarterMail enforces the maximum message size, available mailbox space for local senders, and maximum hop count.
  • DMARC: After the complete message is received, SmarterMail evaluates the sending domain's DMARC policy using the SPF and DKIM results. If DMARC fails and the published policy is p=reject, SmarterMail rejects the message with a 550 response. A p=quarantine failure is accepted but flagged and adds spam weight during spool processing. SmarterMail also verifies ARC (Authenticated Received Chain). A valid ARC chain from a trusted intermediary, such as a mailing list, can override failing SPF or DKIM results.
  • Acceptance: SmarterMail writes the message to the spool as two files: the message itself and a header file containing envelope, session, and spam-check metadata. It then returns 250 OK to the sending server. SmarterMail is responsible for the message after that point.

Phase 2: The spool

SmarterMail processes the spool continuously. After a short configurable delay that allows external programs to see new files, each message goes through the following steps:

  • Blocked senders: SmarterMail evaluates blocked sender and domain lists at the user and domain levels.
  • File type checks: Attachment extensions are compared with the blocked-extension lists at the system and domain levels for incoming and outgoing mail. Messages with blocked attachment types are rejected and generate a non-delivery report to the sender.
  • Antivirus, in order:
    1. Cyren antivirus / outbreak detection (legacy licensed installations only)
    2. ClamAV
    3. Microsoft Defender (Windows installations)
    4. Command-line antivirus / custom spool executable
  • If an engine detects a virus, SmarterMail applies that engine's configured action: quarantine, delete, or inform recipients only.
  • Spam checks, in order (SpamFoo is not part of this pass because it runs once per recipient during local delivery and uses mailbox-specific settings.):
    1. Reverse DNS (rDNS)
    2. Null sender (delivery status and read-receipt reports, which are required to use a null sender, are exempt by default)
    3. Honey pot
    4. Cyren antispam and Cyren IP reputation (legacy licensed installations only)
    5. Message Sniffer
    6. Internal SpamAssassin (SmarterMail’s built-in SpamAssassin rule engine)
    7. Remote SpamAssassin (external spamd servers)
    8. Rspamd (external Rspamd servers)
    9. SPF
    10. DKIM
    11. ARC: Can adjust the SPF and DKIM results as described above.
    12. DMARC scoring (based on the result recorded during the SMTP session)
    13. Custom (body) rules
    14. RBLs and URIBLs: These checks are collected and run in parallel at the end of the spam-check pass.
  • SmarterMail does not repeat checks that ran during the SMTP session; it reuses their recorded results. Each check adds its configured weight, and the total is stored with the message. SmarterMail selects the spam action later, for each recipient, during delivery. 
  • Message archiving: If system-level archiving for all incoming or outgoing messages is enabled, SmarterMail archives the message here, after virus and spam scanning but before content filtering. Per-domain archiving runs later, during local delivery, and also captures the message before content filters modify it.
  • Routing rules: SmarterMail applies incoming and outgoing routing rules, which can redirect the message or its recipients.
  • Delivery: SmarterMail separates recipients into local and remote groups. If a message has both, it completes local delivery before remote delivery.

Local delivery (per recipient)

  • SmarterMail rechecks throttling, mailbox and domain size limits, and domain status. Violations generate a non-delivery report.
  • Per-domain archiving rules run.
  • SmarterMail handles mailing lists, catch-alls, and alias expansion. These can add recipients, which then follow the same per-recipient steps.
  • SpamFoo scan and classification: When licensed and enabled, SmarterMail runs SpamFoo once for each recipient. This machine-learning antispam and classification service adds a configurable spam weight and assigns an inbox category: Primary, Promotions, Transactions, Updates, or Time-Sensitive. SmarterMail writes the result to X-SpamFoo headers on the delivered message and removes inbound X-SpamFoo headers first so they cannot be spoofed. Depending on the license, SpamFoo runs in full antispam mode or classification-only mode. Authenticated and trusted senders bypass SpamFoo antispam scanning, but their messages are still classified.
  • Spam action: SmarterMail compares the stored spam weight, including the SpamFoo result, with the low, medium, and high thresholds. System settings apply by default, with domain or user overrides where available. It then applies the configured action, such as no action, prefix subject, add header, move to Junk Email, or delete.
  • Content filters: Filters run by level: system, including the spam action above; then domain; then user. Within each level, they run from top to bottom. Actions include delete, bounce, move to folder, forward, prefix subject, add header, mark read, set priority, and flag for follow-up.
  • Folder placement: Unless a filter deletes or moves the message, SmarterMail delivers it to the Inbox or to the folder selected through plus addressing, if enabled.
  • Forwarding and automated responses: SmarterMail applies user-configured forwarding and then runs auto-responders with loop detection.
  • Read receipts / delivery status notifications are generated where requested and allowed.

Remote delivery

  • Outgoing spam checks: If outbound spam blocking is enabled, SmarterMail runs the configured outbound spam checks. Messages above the outbound threshold are blocked or quarantined according to the configured action. Outbound rate limits and abuse-detection rules for the sending account also apply.
  • Routing: SmarterMail sends the message through the first applicable route in this order: a gateway selected by routing rules, a configured SMTP account, a smart host for the recipient domain, an outbound gateway, or the recipient domain's MX servers.
  • Retries: SmarterMail retries temporary 4xx failures on the configured schedule, by default after 15, 30, 60, and 90 minutes. Permanent 5xx failures, and messages that exhaust all retries, generate a non-delivery report to the sender. SmarterMail can also send delay notifications to local senders after a configured number of failed attempts.

Whitelisting and trusted senders

SmarterMail runs spam checks for every message unless one of the following exceptions applies:

  • Whitelisted IPs: Messages from IP addresses whitelisted for SMTP spam bypass skip the spam-check pass.
  • Authenticated senders: SmarterMail does not spam-scan messages submitted through an authenticated SMTP session.
  • Incoming gateways: When a trusted SmarterMail incoming gateway has already scanned a message, it passes along the results and SmarterMail does not repeat the checks.

For trusted senders, including system-, domain-, and user-level trusted senders and senders in a recipient's contacts, SmarterMail sets the spam weight to zero during delivery only if the message passes email authentication. SPF, DKIM, and DMARC still run to help prevent From-address spoofing. If the message fails DMARC, or fails both SPF and DKIM alignment for the trusted address, trusted-sender status does not apply and the message is scored normally. Earlier SmarterMail versions were less strict and left only the SPF and DKIM scores in place.

Article ID: 3786, , Modified: Today at 2:52 PM

Was this article helpful?

Share this article
Bluesky
Facebook
Threads
X / Twitter
Other Social Networks
Print