How do I stop spam reaching my business email?

Spam control is layered, and the layers are not equal

Most people attack this problem from the wrong end. They start with the junk folder - training it, tuning it, building rules - and never touch the two settings upstream that decide how much reaches the folder in the first place.

Think of it as four gates. The first is whether the address exists at all. The second is whether the sending host is allowed to be sending as that domain. The third is server-side filtering at delivery. The fourth is your own inbox behaviour. The first two are configuration you do once. The last two are habits. In that order, they do most of the work.

Gate one: stop accepting mail for addresses that do not exist

By default a mail server rejects mail for an address it does not have. Where the recipient "is known not to be a deliverable address, the SMTP server returns a 550 reply, typically with a string such as 'no such user'" [1]. That rejection happens during the conversation between servers, before the message body is accepted.

The standard goes further and treats address-guessing as hostile activity to be repelled: if a server sees "a large number of RCPT TO commands... most or all with invalid addresses" as part of an attack, "it would be reasonable for the server to close the connection after generating an appropriate number of 5yz (normally 550) replies" [1].

A catch-all address disables all of this, because with a catch-all every guess is a valid address. If you have one on, this is the highest-value change available to you, and it takes a minute. The full argument is in should I use a catch-all email address.

The second half of this gate is discretion about what you publish. The standard is blunt that "accepting a message may trigger additional undesirable traffic by providing verification of the address" [1]. Publish the addresses you want strangers to use, and keep the internal ones off the website.

Gate two: make your own domain impossible to forge

A large fraction of the worst mail a small business receives is not generic spam. It is targeted: an invoice that appears to come from your own bookkeeping address, a payment-change request that appears to come from the owner. That works because plain SMTP "places no restriction on what a sending host can use as the MAIL FROM of a message or the domain given on the SMTP HELO/EHLO commands" [2].

Three DNS records close that off.

SPF is the list of hosts authorised to send as your domain [2]. A receiver that gets a "fail" has "an explicit statement that the client is not authorized to use the domain in the given identity", and may reject with a 550 [2]. Note that "softfail" is deliberately weaker and receiving software should not reject on it alone [2], so a lazy SPF record buys you less than you think.

DKIM attaches a cryptographic signature, letting the signing domain "claim some responsibility for a message" in a way the receiver validates by fetching your public key from DNS [3]. Because relays in transit "typically make no substantive change to the message content", the signature survives the journey [3].

DMARC ties those two to the address your customer actually sees. It authenticates use of the From domain by requiring alignment with an authenticated identifier, and it exists because that field "is the one used by end users to identify the source of the message and therefore is a prime target for abuse" [4]. DMARC is "a mechanism for policy distribution that enables increasingly strict handling of messages that fail authentication checks, ranging from no action, through altered delivery, up to message rejection" [4], and it gives you reports on who is sending as you.

Start DMARC in monitoring mode, read the reports for a few weeks, then tighten. The step-by-step is in SPF, DKIM and DMARC explained for small business. The same three records are the main reason your outbound mail does or does not land, which is covered in why your business email goes to spam.

Gate three: filter on the server, not in one app

The classic small-business mess is a set of rules built inside a desktop mail app. They work beautifully on the laptop and not at all on the phone, because they only run when that one program is open. So the phone buzzes for mail the laptop already filed, and the junk folders disagree with each other.

Server-side filtering fixes this by making the decision once, at delivery, before any device sees the message. That is exactly what the Sieve filtering language was designed for: filtering at time of final delivery, "extensible, simple, and independent of access protocol, mail architecture, and operating system", suitable for running on a server "where users may not be allowed to execute arbitrary programs" [5]. It has no loops, no variables in the base language, and no ability to shell out to external programs [5] - constraints that exist so a filter cannot misbehave.

Practically, that means rules like "mail from this supplier goes to this folder" or "anything with this subject prefix is filed" belong on the server. The device-consistency question generally is covered in business email on your phone and laptop.

One caution the standard itself raises: silently deleting mail is dangerous. RFC 5321 says dropping messages without notification "should be considered only in those cases where there is very high confidence that the messages are seriously fraudulent or otherwise inappropriate" [1]. Send suspected spam to a junk folder you can review, not to nothing.

Gate four: stop answering machines

Two habits make measurable difference.

Fix the auto-responder. Automatic responses are a documented source of "significant numbers of useless or unwanted responses", "responses sent to inappropriate addresses" and "occasional incidences of mail loops" [6]. The rule is straightforward: do not issue an automatic response to any message carrying an Auto-Submitted header field with a value other than "no", and mark your own automatic replies with Auto-Submitted: auto-replied so other systems can extend you the same courtesy [6].

Unsubscribe selectively. If you recognise the sender - a supplier, a conference, a newsletter you did sign up for - unsubscribe. Under CASL a Canadian commercial sender must provide an unsubscribe mechanism as part of complying with section 6 [7], and it must work. If you do not recognise the sender at all, do nothing; interacting is exactly the address verification the SMTP standard warns about [1].

What Canadian law gives you

CASL is stronger than most business owners realise. Section 6(1) prohibits sending a commercial electronic message unless the recipient has consented expressly or by implication and the message identifies the sender, provides working contact information and offers an unsubscribe mechanism [7]. Failing on the second half is a breach even where consent exists.

Two details worth knowing. It is immaterial whether the electronic address exists or whether the message reached its destination [7] - the offence is in the sending. And a message sent to a person engaged in commercial activity that consists solely of an inquiry related to that activity is outside section 6 [7], which is why a genuine one-off business question is treated differently from a campaign. If you send marketing yourself, the line is drawn in do I need a mailing list tool, or can I just email my customers.

Where we sit

MapleMail runs filtering on the server, so the same decision applies to your phone, your laptop and anything else you read mail on. We publish and maintain the authentication records for your domain and hand them to you in writing. We do not enable catch-all by default, and we will tell you plainly if you ask us to turn one on.

What we will not claim is that any provider stops all spam. Nobody does. What a well-configured setup does is move the fight upstream, so most of it is refused at the door and the remainder lands in a junk folder you can actually review. Plans and what each mailbox includes are on the pricing page.