How filtering works
Every screen in the console is built on a few ideas: scores add up, the total crosses thresholds, a verdict names what kind of threat it is, and the policy says what to do about it.
The scan, step by step
Before any of this, postscreen drops connections from IPs on Spamhaus ZEN. Those never appear in the message trace - they were refused before a message existed.
Each stage records findings ("rules"), each worth points - positive for suspicious, negative for reassuring (e.g. DMARC pass). Every rule is listed in the rule reference. A broken stage never loses mail: it is marked with an error and the others still decide.
Score and thresholds
| Total score | Default | What happens |
|---|---|---|
| below tag | < 5 | Delivered normally (clean), unless it is bulk mail. |
| at or above tag | 5 | Delivered with X-Obsidian-Spam: Yes and optionally [SPAM] in the subject; your Junk rule moves it. |
| at or above quarantine | 8 | The verdict's action applies - quarantine by default. |
| at or above reject | 15 | Refused during SMTP; the sender gets a bounce from their own server. |
Thresholds are set per policy.
Verdicts
| Verdict | Meaning |
|---|---|
| clean | Nothing significant found. |
| bulk | Legitimate-looking marketing / newsletter mail. |
| spam | Unwanted mail. |
| phish | Tries to steal credentials or payment details, or spoofs a sender. |
| bec | Business email compromise: impersonation aimed at payments, gift cards, payroll or data. |
| virus | ClamAV or Spamhaus HBL identified malware. |
| malware | Attachment rules found malware-like content and the score is high. |
| blocked | The sender is on a block list. |
| policy | An attachment policy was broken (blocked file type, macro, encrypted archive) but the score is otherwise low. |
When a message crosses a threshold, the verdict is chosen from which kind of finding contributed most: phishing, BEC or malware findings win when they make up at least 40% of the suspicious points (and at least 3 points); bulk wins when half the points are bulk; otherwise it is spam.
Some outcomes skip scoring: a virus is always a virus; a block-listed sender is always blocked; an attachment policy violation always applies its action; an allow-listed sender is clean - unless it is a virus, an attachment violation, or fails DMARC on a domain that publishes p=reject (so a spoof of a trusted sender still gets caught).
Actions
- Deliver
- Delivered unchanged (headers added).
- Deliver + tag
- Delivered with
X-Obsidian-Spam: Yes/ subject prefix so it lands in Junk. - Quarantine
- Accepted from the sender, stored in Obsidian, not delivered. Can be released.
- Reject at SMTP
- Refused with a 550 error; the sender's server returns it to them.
- Discard silently
- Accepted and dropped. Use sparingly - nobody is told.
- Hold (AI)
- Parked like quarantine while the AI reviews it, then released automatically if judged clean.
Message and recipient statuses
A message has one overall action and a status per recipient (a message to five people can be released to one of them):
delivered tagged quarantined held rejected released deleted clawed back expired tempfail
tempfail means the message was refused temporarily (for example ClamAV was down) - the sender retries automatically. expired means it outlived the quarantine retention period.
Admin-only
Viruses, malware and phishing quarantined above the threshold are marked admin only. Users see them in their quarantine (so they know something was stopped) but cannot release them; digests show "Admin review" instead of a release link. Which other verdicts users may release is set per policy.
AI review
The model is slow on a CPU server (seconds to minutes), so it is only asked when it can change the outcome: grey-zone scores (from the policy's "ask the model from score" up to the quarantine threshold), BEC indicators, VIP display-name matches, and first-time senders with links. It never reviews outbound mail, viruses or listed senders. Three modes (per policy):
- Hold (default) - the message is held; the worker asks the model; clean → delivered automatically with
X-Obsidian-AI-Review: released, otherwise quarantined. If the model is unreachable longer than the maximum hold, the rules decide. - Async - delivered immediately; if the model then finds phishing, BEC or malware, the message is clawed back from mailboxes through the API connector.
- Inline - the SMTP conversation waits for the model (bounded by the inline timeout). Only sensible with a fast GPU model.
The model's verdict, risk, confidence and reasoning appear in a box at the top of the message page. The email content is fenced off in the prompt and instructions inside an email are treated as evidence of phishing, never followed.
Directions
- inbound
- From the internet to a protected domain.
- outbound
- From a protected domain's server (a relay client or authenticated sender) to anywhere. Authentication, impersonation and AI stages are skipped; viruses and spam are still stopped so your tenants don't get blacklisted.
- api
- Read from a mailbox by an API connector (API mode).
Trusted internal networks. Servers on your own LAN (web-server cron jobs, applications, copiers) often send as your own domain without SPF or DKIM. List their ranges in Settings › Mail flow › Trusted internal networks: their mail skips the authentication, spoofing, impersonation and AI checks but is still scanned for viruses, attachments, links and content.
First-time senders and VIPs
A sender is "first-time" until the organization has received clean mail from that address or sent mail to it (look-back 180 days). VIP users are marked on the Users page; their display names are protected against outside use.
Organizations and scope
An MSP administrator sees every organization; the organization picker on list pages filters. An organization administrator only ever sees their own organization's mail, users, domains, lists and audit entries.