Overview
The DeepFilter Antispam System is an email security gateway that filters your organization's email traffic against threats coming from the internet. It runs on your own server; your email flow never passes through a third party's cloud.
The product does not replace your existing email server. It sits in front of it: DeepFilter receives email arriving from the internet first, scans it, and delivers what it finds clean to the organization's email server.
What problem it solves
Corporate email servers (Exchange, Zimbra and the like) are good at mailbox management, but on their own they do not offer adequate protection against spam, phishing, malicious attachments and forged-sender attacks. DeepFilter takes over that layer:
- Filtering out spam and unsolicited bulk mail
- Catching phishing and brand impersonation attempts
- Malware scanning (antivirus) and blocking of risky file extensions
- Sender reputation, blacklist lookups and sender authentication checks
- Quarantining suspicious email and reporting it to the end user
On top of that, all of your email traffic is recorded; you can go back through the panel and see which email was blocked and why.
Where it sits in the email flow
DeepFilter becomes the first stop advertised by your domain's MX record. The sending server no longer connects directly to the organization's email server — it connects to DeepFilter first:
The default quarantine threshold is 12. This value can be changed from the panel.
DeepFilter can be used for outbound email as well: the organization's email server is configured so that outgoing mail leaves through DeepFilter, and that traffic is recorded too.
Why quarantine rather than rejection
DeepFilter does not reject an email outright in the SMTP session as a result of scanning.
When an email is rejected, the sending side usually generates a "delivery failed" notification. In spam and phishing email the sender address is almost always forged, so that notification goes to the innocent third party whose address was spoofed. This is called backscatter, and it both bothers that person and damages your server's reputation.
Instead, DeepFilter quietly places the suspicious email in quarantine. The email is not lost; it is kept in the panel, it can be reviewed and, if necessary, released and delivered to the recipient.
Quarantined email is not kept indefinitely: by default it is deleted automatically after 30 days. This period can be changed from the panel; the minimum is 1 day and there is no upper limit.
Quarantined email is stored on the server's disk. Extending the retention period — especially leaving it with no upper limit — means that much more email is held on disk and that more disk space must be set aside. The "no upper limit" setting does not mean the server will store an unlimited amount of email; the amount that can be stored is bounded by the capacity of the disk. If you are planning long retention periods, size your disk space accordingly.
Quarantine does not mean "the email was deleted". An email caught by mistake (a false positive) can be released with a single click from the panel or from the end user portal.
Who it is for
DeepFilter is designed for organizations that run their own email server and want to keep email security under their own control. The typical usage profile:
- Organizations with their own Exchange, Zimbra or similar email server
- Organizations whose email content and records must stay within the organization's boundaries
- Organizations that want to reduce their dependence on cloud-based filtering services
- IT teams that want fine-grained control over their own email security rules
A single DeepFilter server is recommended for traffic of up to 200,000 emails per day. Actual capacity varies with the server hardware and the traffic profile. For volumes above that, horizontal scaling is recommended: several independent servers are installed and the load is distributed across them through MX records.
Horizontal scaling is a load distribution method. The servers do not form a shared pool: each server requires its own license, quarantine is not shared, and management is performed separately on each server. See the relevant section for details.
Components running on the server
DeepFilter is an integrated system that arrives in a single installation. The administrator does not need to install or manage these components one by one; all of them are configured during installation.
| Component | Role |
|---|---|
| Email transport service | Email reception and delivery |
| Scanning engine | Scanning and scoring |
| Antivirus engine | Malware scanning |
| Application database | Settings, users and quarantine records |
| Analytics database | Email traffic analytics and reporting |
| Cache and queue service | Fast-access data and job queue |
| Local DNS resolver | Resolution of reputation, SPF and MX lookups |
| AI evaluation service | Machine learning based classification |
| Web interface and management API | Management panel and end user portal |
What to know before installing
DeepFilter is installed on Rocky Linux 9 Minimal (x86_64) only, and installation requires internet access. Installation packages are downloaded from remote repositories; an installation isolated from the internet (offline) is not supported.
Outbound access is also required at run time: license validation, updates, spam and malware database synchronization, and DNS-based reputation lookups all depend on it.