Strengthening Our Inbound Email Defenses

We've rolled out a series of improvements to how KaiMail handles inbound email at the SMTP level. These changes are designed to stop spam and abuse before messages ever reach your inbox — blocking bad actors at the door rather than sorting through their mail after the fact.

Here's what's new and why we made these choices.

What We Now Check

All of these protections operate at the connection and envelope level — during the SMTP handshake, before any message content is transferred. This means rejected mail never consumes your forwarding quota or storage.

DNS-Based Blacklist Lookups

Every connecting IP is checked against multiple well-established real-time blacklists. Servers that are already known sources of spam — compromised machines, open relays, bulk senders with poor reputations — are rejected immediately. We query several independent blacklist providers to reduce false positives while maintaining broad coverage.

Greeting Delay (Earlytalker Detection)

Legitimate mail servers wait for our SMTP banner before sending commands. Many spam bots, however, start blasting data the instant a connection opens. We now enforce a short pause before presenting our greeting. Any client that sends data before being invited to speak is disconnected. This single technique is remarkably effective against high-volume automated spam tools.

Reverse DNS Validation

We verify that the connecting IP address has a valid reverse DNS (PTR) record and that the record resolves correctly. A properly configured mail server will always have functioning reverse DNS. Its absence is a strong signal that the sending host is misconfigured or not a legitimate mail server at all.

Sender Domain MX Validation

When a sender claims to be from a particular domain, we check whether that domain actually has MX records — meaning it's set up to handle email. Mail from domains with no MX record is rejected. This catches a large volume of spoofed and throwaway sender addresses.

Recipient Rate Limiting

We cap the number of recipients a single connection can address. This prevents address-harvesting attacks, where a spammer enumerates thousands of possible addresses to discover which ones are valid. Legitimate senders rarely need to address more than a handful of recipients in a single SMTP session.

Trusted Sender Bypass

Known-good IP addresses — such as monitoring services and partner infrastructure — can be whitelisted to bypass these checks, ensuring that legitimate automated mail flows are never disrupted.

The above steps and techniques are nothing new: They are standard best practices if you're running an email system.

What We Deliberately Don't Do

Just as important as what we check is what we've chosen not to do. Our anti-spam approach is guided by a core principle: we don't read your email.

No Content Scanning or Keyword Filtering

We do not inspect the body of your messages for spam keywords, suspicious phrases, or pattern matches. Content-based filtering is inherently invasive and error-prone — it requires reading every message and making judgment calls about what "looks like spam." That's not our role. Your email content is yours.

No Bayesian or Statistical Analysis

We don't build probability models from your message content. Bayesian filters need to be trained on your mail, which means storing and analyzing message bodies. We've opted out of this entirely.

No Machine Learning or AI-Based Filtering

We don't feed your messages into ML classifiers or neural networks. While these tools can be effective, they require deep content inspection and introduce opaque decision-making that's difficult to audit or explain.

No Greylisting

Greylisting — temporarily rejecting mail and waiting for a retry — can catch some spam but adds unpredictable delays to legitimate email delivery. For a forwarding service where timely delivery matters, the tradeoff isn't worth it.

No Attachment Scanning

We don't unpack or inspect attachments. Your files pass through as-is.

The bottom line: every check we perform uses information that's already visible in the SMTP envelope and DNS infrastructure — the connecting IP, the sender's domain, and the protocol behavior. We never need to open the envelope.

Best Practices for Our Users

These server-side protections work best alongside good domain hygiene on your end:

• Publish SPF records for your custom domains so receiving servers can verify that forwarded mail is authorized.
• Keep your MX records pointed correctly at KaiMail — misconfigured DNS is the most common cause of delivery issues.
• Use strong, unique passwords for your KaiMail account and any SMTP sending credentials.
• Monitor your forwarding logs in the KaiMail dashboard. If you see repeated bounces or unexpected patterns, reach out to support.

Further Reading on Email Anti-Spam Best Practices

Our approach is one piece of the puzzle. Here are recommendations from other organisations worth reading:

• CISA: Reducing Spam — The US Cybersecurity and Infrastructure Security Agency recommends being cautious about where you share your email address, using email filters and spam tagging, and never following links in spam messages (which confirms your address is valid to the spammer).
• Google: Email Sender Guidelines — Google requires all senders to authenticate with SPF or DKIM, maintain valid reverse DNS records, and keep spam complaint rates below 0.3%. Bulk senders (5,000+ messages per day) must also implement DMARC. Non-compliant messages face rejection as of November 2025.
• Proofpoint: Stricter Email Authentication Enforcements — Proofpoint stresses that SPF, DKIM, and DMARC alignment is not a quick fix but infrastructure work requiring cross-team coordination. They recommend starting with a DMARC policy of p=none for monitoring and working toward p=reject for full protection against domain spoofing.
• Twilio SendGrid: Tips to Keep Email Out of the Spam Folder — SendGrid emphasises building email lists organically with double opt-in, authenticating all outgoing mail with SPF, DKIM, and DMARC, and monitoring engagement metrics closely. Declining engagement is a major trigger for spam folder placement.
• CISA: Enhance Email and Web Security — CISA's guidance for organisations recommends configuring DMARC with a policy of reject, requiring multi-factor authentication for all email accounts, and stripping or blocking emails containing active content like macros by default.

Looking Ahead

These improvements represent our philosophy: block bad traffic early, at the network level, using well-proven techniques — and leave your message content alone. We'll continue refining our SMTP-level protections as the threat landscape evolves, always with privacy and transparency as guiding principles.

If you have questions about these changes or notice any delivery issues, contact us at [email protected].