GoAdmio
GoAdmio Documentation

Email Content Filtering

From the GoAdmio knowledge base.

Email Content Filtering

This page explains the Email Content Filtering feature in GoAdmio. It lets you block incoming email based on words or phrases found in the message header or message body — a content-based spam filter that complements IP blocking.

Location: Admin Panel → Email → Email Content Filtering
Location (User Panel): Email → Email Content Filtering


Overview

The Email Content Filtering screen (also labeled Spam Filters) lets you define keyword rules that reject or discard incoming email before it reaches a mailbox. A rule matches on a Type (Header or Keyword) and a keyword or phrase, and any message matching the rule is blocked.

This is the direct content-based counterpart to IP Spam Filter:

| Feature | What it blocks on | Best for |
|---|---|---|
| IP Spam Filter | Sender IP address | Known spam sources, repeat offenders |
| Email Content Filtering (this page) | Words/phrases in header or body | Spam campaigns, specific abusive terms, product names |

> Note: Content filtering is powerful but requires care. Blocking common words (e.g., "free", "click", "sale") will catch spam but also legitimate mail. Start with specific, high-value keywords rather than broad generic terms.


What the Page Shows

The Spam Filters table lists every active rule:

| Column | Description |
|---|---|
| Type | The match type — Header or Keyword |
| Keyword | The word or phrase that triggers the block |
| Actions | Edit or delete the rule |
| Footer | Showing 0 of 0 records — the current rule count |

> Tip: The record count at the bottom reflects how many rules are active. If a customer reports that spam is still arriving, verify that rules actually exist and are enabled.


Rule Types

Header

Matches a word or phrase in the message headers — the technical envelope around the message.

| Header field | What it contains | Useful for |
|---|---|---|
| Subject | The subject line | Catching campaign subject lines |
| From | The sender address | Blocking specific senders |
| Reply-To | The reply address | Catching spoofed replies |
| X-Mailer | The sending software | Blocking known spam tools |
| Message-ID | Unique message ID | Rarely useful for rules |
| Received | The delivery path | Catching a specific relay or IP |

Example header rules:

| Type | Keyword | Effect |
|---|---|---|
| Header | X-Mailer: PHPMailer | Blocks mail sent via a specific mailer (often used by spammers) |
| Header | From: *@spamdomain.com | Blocks all mail from a domain |
| Header | Subject: Viagra | Blocks messages with that word in the subject |

> Tip: Header rules are more precise than body rules — a spammer can hide words in the body, but headers are structural and harder to obfuscate.

Keyword

Matches a word or phrase in the message body (and often the subject, depending on the filter engine).

| Example | What it catches | Risk |
|---|---|---|
| casino | Gambling spam | Low — unlikely in legitimate mail |
| bitcoin | Crypto spam | Medium — legitimate finance mail may use it |
| free money | Scam campaigns | Low |
| unsubscribe | Some spam, but also legitimate newsletters | High — blocks real mailing lists |
| click here | Generic spam | High — legitimate marketing uses this |

> Warning: Body-keyword rules are prone to false positives. A rule on the word free will block legitimate order confirmations, newsletters, and personal mail. Use multi-word phrases (e.g., free money now) or highly specific terms rather than single common words.


How to Add a Filter Rule

  1. Log in to the GoAdmio Admin Panel (or User Panel).
  2. Navigate to Email → Email Content Filtering (or Spam Filters).
  3. Click Add Rule (or Add Filter).
  4. Select the Type:
- Header — match against a header field - Keyword — match against the body/subject
  1. Enter the Keyword or phrase.
  2. Optionally set the action:
- Reject — return an SMTP error to the sender (sender knows it was blocked) - Discard — silently drop the message (sender thinks it was delivered) - Quarantine — hold the message for review (if supported by your version)
  1. Click Save.
The rule takes effect immediately for the selected scope.

Scope: Server-Wide vs. Per-Account

Like the IP Spam Filter, content filtering can apply at two levels:

| Scope | Managed by | Affects |
|---|---|---|
| Server-wide | Server administrator (root) | All domains on the server |
| Per-account | Account owner (User Panel) | Only that account's domains |

> Tip: Use per-account rules for customer-specific spam patterns. Reserve server-wide rules for broad, universally undesirable content (e.g., known malware campaigns, phishing phrases).

> Warning: A server-wide keyword rule that is too broad can disrupt every customer. Test per-account first, then promote to server-wide only after confirming low false-positive risk.


How It Works

When a message arrives:

  1. GoAdmio reads the message headers and body.
  2. It checks each active rule (server-wide first, then per-account).
  3. If a Header rule matches, the header value contains the keyword — block.
  4. If a Keyword rule matches, the body or subject contains the keyword — block.
  5. If any rule matches, the message is rejected or discarded per the rule action.
  6. If no rule matches, the message proceeds to normal delivery and (if enabled) AI contact detection.
> Note: Content filtering happens after the SMTP connection is accepted. This means the server has already received the message data before blocking it — unlike IP Spam Filter, which blocks before message data is transferred. For high-volume spam, combine both: IP blocking for known sources, content filtering for everything else.

Example Rules

Block a specific spam campaign

| Type | Keyword | Action |
|---|---|---|
| Header | Subject: Your account is suspended | Reject |
| Keyword | click here to verify your account | Reject |

Block a persistent sender domain

| Type | Keyword | Action |
|---|---|---|
| Header | From: *@badspammer.com | Reject |

Block a mailer used only by abuse

| Type | Keyword | Action |
|---|---|---|
| Header | X-Mailer: PHPMailer | Discard |

Block crypto/gambling spam

| Type | Keyword | Action |
|---|---|---|
| Keyword | casino bonus | Discard |
| Keyword | crypto giveaway | Discard |

Block a language you do not serve

| Type | Keyword | Action |
|---|---|---|
| Keyword | халява (Russian spam term) | Discard |


Best Practices

| Practice | Why |
|---|---|
| Use specific phrases, not single words | free money now is safer than free |
| Prefer Header rules | Headers are harder for spammers to obfuscate |
| Start per-account | Test the rule before applying it server-wide |
| Log what you block | Review /var/log/maillog to confirm the rule is catching spam, not legitimate mail |
| Review rules periodically | Spam tactics change; stale rules may cause false positives |
| Combine with SPF/DKIM | Authentication catches spoofing; content filtering catches the rest — see SPF / DKIM |
| Educate customers | Tell them to use specific keywords and monitor their own rules |
| Do not block on "unsubscribe" | Legitimate mailing lists require it |


Verifying a Rule

Check the mail log

```bash
grep "content filter" /var/log/maillog
grep "554" /var/log/maillog

↑