The eight-stage inbound pipeline, stage by stage

Every message that arrives at MxGuard passes through eight sequential stages before it reaches your mail server. Understanding them helps explain why a given message was blocked, tagged or delivered.

1. Postscreen — connection-level triage. Six DNSBLs (including Spamhaus, SORBS and Mailspike) are queried at connect time; three or more hits blocks the connection outright. The trusted-sender list list.dnswl.org provides a bypass for known-good senders.
2. Envelope — SPF is validated via policyd-spf and connection rate limits are applied (30 connections/min, 60 messages/min, 100 recipients/message).
3. Recipient — MxGuard probes your real mail server at SMTP time to confirm the recipient address actually exists, which prevents backscatter.
4. Content — ClamAV antivirus scanning, DKIM signature verification, DMARC alignment enforcement, and three URIBL lookups (multi.uribl.com, multi.surbl.org, dbl.spamhaus.org).
5. Milter — feature extraction from headers, body, URLs and attachments, producing around 120 ML features.
6. Hybrid AI brain — two-layer scoring combining the LightGBM classifier with Claude for uncertain cases.
7. ARC seal — authentication results are preserved through forwarding using openarc.
8. Backend delivery — clean mail is forwarded on to your real mail server.

Because the cheap, decisive checks run first, the vast majority of junk is rejected before it ever reaches the expensive AI stages.