Rules
Why EmailIntel Rules Trigger
EmailIntel does not just label messages. It explains why something looked normal, suspicious, or risky. This page is the plain-language reference for the main rule families in the current rule set.
Authentication Rules
These rules look at SPF, DKIM, and DMARC. They do not prove a message is good or bad on their own. They tell you whether the sender's technical setup and the visible sender identity line up the way they should.
Sender Rules
Sender rules compare the visible sender, the transport sender, the reply path, and the sender domains. They also look for cases where the visible sender sits on cheap or unrelated infrastructure, or where the display name appears to claim a different organization than the domain actually belongs to.
Infrastructure Domain Checks
If a visible sender is using something that looks like a raw VPS host, a generic outbound relay host, or a cloud infrastructure hostname rather than a real organization domain, that can be a useful signal.
Link Rules
Link rules look for destinations that are odd, risky, or unrelated to the sender. Common checks include suspicious top-level domains, raw IP hosts, lookalike domains, and link destinations that do not align with the sender's domain story.
DNS Blacklists
A DNS blacklist is a published list of IP addresses that have been associated with spam, abuse, or suspicious mail behavior. Security tools can query these lists quickly during analysis.
A listing is not a final verdict. Shared infrastructure, bulk mail platforms, or abused cloud servers can all show up in blacklists. The point is context: why is the IP listed, what kind of message is this, and do other signals line up?
Attachment Rules
Attachment rules look for file types that are often abused, as well as mismatches between the filename extension and the MIME type. That matters because attackers often try to disguise the true type of an attachment.
Header Rules
Header rules look for structural oddities such as missing important headers or route patterns that do not make sense. They are not flashy rules, but they are useful for spotting malformed or operationally sloppy mail.
Combined Signals
Some warnings are only moderately suspicious on their own. But when several of them happen together, the overall risk goes up. EmailIntel uses grouped signals to reflect that. A message with a weak auth result, odd sender identity, and risky route clue is more concerning than a message with only one of those.