Domain & DNS Dictionary
Spam filtering: the good version is a change to your zone
A renewal notice and an auth code both went to quarantine, and you found out from the registry instead.
The short answer
A spam filter grades arriving mail on content, sender reputation and authentication results, then routes the junk away before it reaches you.
Where it sits decides how much it can do, and the strongest position is a DNS decision rather than a mail one: putting a filtering service in front of your mailboxes means repointing the name's MX records at that service, and having it relay onward to your host.
Which brings a second obligation. A filter that swallows a renewal notice, a transfer approval request or an auth code delivery has cost you more than an afternoon of junk ever did.
By the Hosting & Domains team · Reviewed 18 August 2026
100+
Entries in the domain dictionary
2 min
To read one entry
Plain
English, all the way through
24/7
Someone on the desk, always
Filtering happens at three levels. At MX level a message is judged before your server has agreed to take it, and can be refused outright. Filters on the server sort whatever gets through. Rules inside your own mail app tidy the remainder, device by device.
There is a permanent trade here: catch every piece of junk, or never lose a message that mattered. The uncertain middle wants a human glance rather than silent deletion, which is what a quarantine digest is for.
Three places a filter can sit, one of which touches your zone
Client-side rules affect one device. Server-side filtering affects one mailbox on one host. MX-level filtering affects everything addressed to the name, because it is the first thing the sending world reaches, and that is the only one of the three that requires an edit to your DNS.
So the strongest filtering also carries the most risk of getting it wrong, for a reason that has nothing to do with spam: you are changing where mail for the whole name is delivered.
What changing MX for a filter actually involves
You replace the existing MX records with the provider's hostnames and priorities, and you configure them with your real mail host as the downstream destination. Both halves have to be right. Point MX at the filter without telling the filter where to relay onward and mail is accepted and then discarded, which is worse than a bounce because nobody is told.
Lower the TTL on the MX records a day before you make the change and you keep the ability to reverse it in minutes. Also check that the mail host will still accept mail from the filter's addresses; a host expecting to be the MX itself can be sceptical of a relay it does not recognise.
The messages you cannot afford to lose
Expiry and renewal notices. Transfer approval and refusal requests, which usually carry a deadline of a few days. Registry verification messages. Auth codes. Every one of them is transactional mail from a sender you have no relationship history with, sent to an address that gets almost no other traffic, which is very nearly a description of what filters are trained to be suspicious of.
Allow your registrar's sending domains explicitly, and read the quarantine digest during any window where a renewal or a transfer is live. This is the failure mode we get called about, and it is entirely preventable.
Tuning against evidence rather than nerves
Where thresholds, allow lists and quarantine behaviour are adjustable, set them mid-range, spend a fortnight reading what gets held, and tighten against what you actually saw. Releasing from quarantine also teaches the filter, so it is worth doing properly rather than deleting in bulk.
And remember what a good filter cannot fix: mail of yours going to other people's junk folders. That is an authentication job. Read on into SPF, DMARC, Phishing and Catch-All Address. Support means a person at any hour.
Terms we explain twice a week on the support desk
A term nobody explained is, to us, a service defect. This is the desk's own collected vocabulary, published where a search engine can hand it over on our behalf.
Support means a person at any hour, and the remit covers the awkward practical questions other hosts hand straight back.
- 100+ entries, written in plain English
- Registry, registrar, reseller and host kept apart
- The record, the clock and the failure mode named
- Written by the people who run the transfers
Why Hosting & Domains
Standard on every plan
The failure mode, not just the definition
Each term arrives with the thing that breaks when it is wrong — usually email, and usually quietly.
Written from the registry outwards
Every entry says where the record actually lives, and which of registry, registrar or host owns it.
Examples from real zones
Record names, selectors and hostnames as you would actually type them, rather than an abstract diagram.
Registry, registrar, reseller, host
Four parties with four different powers. We keep them apart, because that distinction is the whole job.
Cross-referenced on purpose
Neighbouring records and protocols point at each other, so one lookup turns into working knowledge.
Spam Filtering, located
Spam Filtering defined, located in the zone, and pointed at the panel screen that actually holds it.
Quick Start
Order placed to site online
- 1
Find the record, not the setting
Open the DNS zone for the name and read what is actually published there. A term stops being abstract the moment you see it in your own zone.
- 2
Copy the zone before you touch delegation
Every record written down while the old nameservers still answer. That single habit prevents most of the failures described on this site.
- 3
Read the neighbouring entries
Names travel in groups — SPF, DMARC and Phishing complete this one's picture, each a two-minute read away.
Built In
Fitted to every plan
- NVMe SSD storage under every tier, not only the dear ones
- A copy taken daily, and restores you run yourself
- DDoS filtering taken at the network edge
- Year one of the name included when you order annually
- WordPress and 400+ further applications in a single click
- SSH, Git and Composer available on the developer plans
- A person on the support desk every hour of every day
- LiteSpeed caching inside the server, not bolted on by plugin
- WebP image optimisation included, nothing added to the invoice
- Spam and virus screening on every mailbox, on by default
Frequently Asked
Questions we field again and again
Does putting a filter in front of my mail change my DNS?
Yes, and that is the defining feature of the arrangement. The name's MX records are repointed at the filtering service, which then relays clean mail to your actual mail host. Two settings have to agree: the MX records in your zone, and the downstream destination configured at the filter.
How do I stop registrar and registry mail being filtered?
Allow the sending domains your registrar uses, before you need them rather than afterwards, and read the quarantine digest during any live renewal or transfer window. That mail is low-volume, transactional and from an unfamiliar sender, which is exactly the profile a filter treats with suspicion.
Can filtering stop my own mail landing in other people's junk?
No. An inbound filter has no influence on how your outbound mail is judged elsewhere. That is settled by SPF, DKIM and DMARC in your zone, plus the sending reputation attached to the name. Two separate problems that get reported as one.
How is a renewal actually billed?
By credit or debit card through a secure checkout, at the same rate as the original order. Every invoice sits in your client area, and auto-renewal is a toggle in the account rather than a phone call.
Keep reading
Dedicated Cloud
Reserved resources with cloud flexibility, a step above a VPS.
Domain Names
Find, register and transfer names, with year one free on annual hosting.
Changing provider? Work through this checklist beforehand.
A straightforward running order for a migration your visitors never spot: which files travel first, how to bring the mail across without dropping a single message, the right moment to repoint DNS, and the two errors that sit behind almost every outage we get called in to fix.
Filter the junk, not the renewal notice.
NVMe hosting with the certificate and the move included, and a renewal figure that does not climb.
View Dedicated Cloud plans