Architecture and Components
DeepFilter is an email security gateway that sits in front of your organization's email traffic. Email arriving from the internet reaches DeepFilter first, is scanned there and, depending on the outcome, is either delivered to your destination email server or placed in quarantine.
This page explains, at an administrator level, which parts the product consists of and the path an email follows inside the system.
Single-Server Architecture
All DeepFilter components run on a single server. You do not need to install a separate database server, a separate scanning server or any additional infrastructure component. Once installation is complete, everything from email reception to the web interface is ready on the same machine.
For traffic above 200,000 emails per day, the load is distributed by installing several independent DeepFilter servers instead of a single one; this is called horizontal scaling. That figure varies with the hardware and the traffic profile; its rules and limits are covered under a separate heading.
DeepFilter is installed on Rocky Linux 9 Minimal (x86_64) only, and installation requires internet access. See the relevant installation pages for hardware and network details.
Components and Their Roles
All of the components below are configured automatically during installation. In normal use you do not deal with them directly; all management is done from the web interface.
| Component | Role |
|---|---|
| Email transport service | Receives emails from the internet and forwards them to the destination email server after scanning. |
| Scanning engine | Assigns each email a risk score based on sender reputation, content, links and authentication results. |
| Antivirus engine | Inspects malicious attachments and file signatures. |
| AI evaluation service | Machine learning based classification. Evaluates spam and fraud patterns that classic rules cannot catch. |
| Application database | The database that holds settings, user and permission information, and quarantine records. |
| Analytics database | Email traffic analytics. The historical traffic data in panel reports comes from here. |
| Cache and queue service | Provides fast access to data used frequently during scanning. |
| Local DNS resolver | The server's own DNS resolver; resolves reputation list, SPF and MX lookups directly. |
| Management API | The back end of the web interface. Applies the setting changes you make to the system configuration. |
| Background task service | Scheduled jobs: database synchronization, quarantine digest delivery, backup, maintenance. |
| Web interface and web server (reverse proxy) | Serves the management panel and the end user portal, and terminates the secure connection. |
Email Flow
An inbound email follows the path below, from the moment it is received to the decision.
The checks in the scanning chain work together and their results are summed into a single numeric risk score. The higher the score, the more likely the email is unwanted. Whatever the outcome, every email is recorded in analytics; it can be searched from the panel and the reason for that decision can be seen.
The quarantine threshold is 12 by default. This value can be changed from the panel. Lowering the threshold means more aggressive filtering (and a higher risk of false positives), while raising it means looser filtering.
Quarantined email is not deleted immediately. Administrators can see quarantined email from the panel and end users from their own portal, and release it when necessary.
Quarantined email is not kept indefinitely. The default retention period is 30 days; at the end of that period the email is deleted automatically. The period can be changed from the panel (minimum 1 day, no upper limit).
Why There Is No Outright Rejection
As a result of scanning, DeepFilter does not reject an email outright. High-scoring emails are quarantined instead of rejected.
In spam and fraud email the sender address is almost always forged. If an email is rejected after being received, the rejection notice goes to the forged sender address and reaches the innocent user who actually owns that address. This is called backscatter. Servers that generate backscatter end up on reputation lists before long, and your own outbound email starts being blocked by other organizations.
The quarantine model is also reversible: a legitimate email caught by mistake can be released from quarantine and delivered to the recipient. A rejected email, on the other hand, cannot be brought back.
Since emails are not rejected, the right way to track filtering quality is to review quarantine regularly. Checking quarantine frequently during the first weeks after installation lets you tune the threshold and the allow lists to your organization's traffic.
Outbound Email
DeepFilter can process not only inbound traffic but also email leaving the organization for the internet. To do this, your own email server's IP address is defined in the panel as an authorized sender; email arriving from that address is treated as outbound traffic and forwarded to the outside world through this server.