# Spam and virus filtering
Source: https://docs.webgee.com/en/email/spam-and-virus-filtering



How WebGee filters inbound mail. Applies to every mailbox on shared, reseller and
Workspace plans. Filtering is on by default and there is nothing to enable.

Every incoming message is scanned by **MailScanner** for viruses and dangerous
attachments, then scored by **SpamAssassin**.

## What happens to a message [#what-happens-to-a-message]

| SpamAssassin score    | Result                                         |
| --------------------- | ---------------------------------------------- |
| Low                   | Delivered normally                             |
| Probably spam         | Delivered, with `{Spam?}` added to the subject |
| Almost certainly spam | Rejected — not delivered at all                |

Tagging rather than quarantining is deliberate: nothing borderline is held
somewhere you have to remember to check. You can filter on the tag in your mail
client or in webmail under **Filters**.

## The `{Disarmed}` tag [#the-disarmed-tag]

`{Disarmed}` in a subject line means MailScanner removed something risky from
the message body while delivering the rest. Two things trigger it:

* **Web bugs** — tiny tracking images used to detect whether you opened a
  message.
* **IFrames** — historically an attack vector against Outlook. They are also
  common in legitimate mailing lists, which is why these messages are disarmed
  rather than rejected.

The message is safe to read. Some formatting may be missing.

## Blocked attachments [#blocked-attachments]

Messages carrying certain attachment types are rejected regardless of their spam
score, because the file type itself is the risk.

**Executables and scripts:** `.exe`, `.com`, `.bat`, `.cmd`, `.scr`, `.pif`,
`.vbs`, `.vbe`, `.jse`, `.sct`, `.hta`, `.cpl`, `.job`, `.reg`, `.scf`, `.shb`,
`.shs`, `.lnk`, `.ins`, `.cnf`, `.vsmacros`

**File types with a history of buffer overflows:** `.ani`, `.cur`, `.ico`,
`.bmp`, `.chm`, `.hlp`, `.its`, `.mhtml`

**Office and data files flagged by Microsoft:** `.mad`, `.maf`, `.mag`, `.mam`,
`.maq`, `.mar`, `.mas`, `.mat`, `.mau`, `.mav`, `.maw`, `.mda`, `.mdz`, `.prf`,
`.pst`, `.tmp`, `.vss`, `.vst`, `.vsw`, `.ceo`

Messages are also rejected when a filename:

* is longer than 150 characters,
* contains more than 10 consecutive spaces, or
* hides its real extension behind a CLSID, such as
  `report.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}`.

All three are techniques for disguising an executable as a document.

## Send a blocked file type anyway [#send-a-blocked-file-type-anyway]

Put it in a password-protected archive, or share it by link from cloud storage.
Do not rename the extension — the filter inspects file contents, not just the
name, and a renamed executable is still rejected.

## If legitimate mail is being tagged [#if-legitimate-mail-is-being-tagged]

See [Why are my emails being marked as spam?](/en/email/why-are-my-emails-being-marked-as-spam),
which covers both receiving and sending.

For adjusting thresholds on your own domains, see
[Configure MailScanner in cPanel](/en/email/configure-mailscanner).

## Related [#related]

* [Configure MailScanner in cPanel](/en/email/configure-mailscanner)
* [SpamExperts is being retired](/en/email/spamexperts-retirement)
* [Obtain email headers](/en/email/how-to-obtain-email-headers-a-step-by-step-guide)