Product demo
See a verdict being explained.
Four situations a mail filter actually has to handle, with the evidence behind each decision. Everything on this page is synthetic: invented people, reserved example domains, inert links, and no connection to mail, quarantine, a mail platform or an incident. Nothing here can act on anything.
This demonstration needs JavaScript. Without it, How It Works describes the same pipeline in prose, and the investigation capabilities list what the console shows for a real message.
2. The evidence
3. The decision
4. Who it reached
5. What you can do
Want this against your own mail instead of ours? Request a Demo — one domain, in Monitor Mode, with verdicts recorded but not enforced while it runs.
How a message score is built
Each scanning stage that runs adds a score of its own. The weighted total is compared with two per-domain thresholds: at or above the quarantine threshold the message is held, and at or above the higher reject threshold it is refused. Below both it is delivered. Two exceptions outrank the total on an enforcing domain: a virus the antivirus stage confirms is refused whatever the score, and a sender on the domain's allow list is delivered whatever the score unless an attachment raised a finding.
- Every stage that ran is shown with its own score, so a total can be taken apart rather than argued about. A stage that did not run, timed out, or could not read an artifact is reported as exactly that, never as a pass. An encrypted archive the gateway cannot open is a coverage gap, not a clean result.
- The thresholds are recorded with the message. The decision shows the quarantine and reject thresholds that applied when that message was scored, so a verdict can be checked against the policy that produced it, not today's.
- Two rules exist to stop over-blocking. A verified sender suppresses heuristics that only make sense for unverified mail, and a non-critical AI verdict cannot cross the quarantine line on its own.
- Authentication is counted once. How SPF, DKIM and DMARC combine, and what each result means, is on the authentication page.
Investigating a false positive
When a message someone needed was held, the record behind the verdict answers why. The same steps work on your own mail in the console.
- Find the message. Search message tracking by sender, recipient or subject.
- Read the decision first. One sentence states what happened and why, with the thresholds that applied. In Monitor Mode it says what scoring would have chosen.
- Find the deciding stage. Take each stage's score away from the total in turn. The stage without which the message would have been delivered is the one that decided it, and usually the only one worth changing.
- Check authentication. A legitimate sender whose own SPF or DKIM is broken often scores on authentication alone. That is their configuration to fix, and an allow-list entry for them should be backed by authentication, not just a name.
- Release it, then fix the cause. Release delivers the stored original message and bypasses re-scanning. The fix is a per-domain threshold, a stage switched off for that domain, or a list entry. A rejected message is discarded rather than held, so it cannot be released.
The guide to investigating a disputed verdict covers both directions — held mail and mail that got through — with a reply you can send the customer, and the evaluation guide covers doing this across a whole sample of verdicts before enforcement is switched on.