How inbound mail is scored

Every inbound message is scored by Rspamd before it is delivered. The score is built from sender reputation, phishing heuristics, content signals and the authentication results — whether SPF, DKIM and DMARC passed for the sending domain.

Below the threshold, the message is delivered normally. Above it, the message is held rather than silently dropped, so a false positive is recoverable rather than invisible.

Scoring happens before delivery, not after. That is what stops a bad message being in the mailbox at all, rather than being moved out of it a moment later.