Skip to content
Spamjadoo

Spam blocked at the door, not in the hallway.

Spamjadoo rejects unwanted mail during the SMTP handshake, the conversation between sender and receiver before any message content is transmitted, by evaluating the connecting IP, greeting, sender and recipient at each of five stages and answering with a 550 error the moment one fails.

illustrative session · spamjadoo mx, port 25 
S: 220 mx1.example.net ESMTP Spamjadoo readyC: EHLO bulk-sender-7731.cheap-vps.exampleS: 250-mx1.example.net Hello [203.0.113.87]S: 250-STARTTLSS: 250 PIPELININGC: MAIL FROM:<promo@offers-daily.example>S: 250 2.1.0 Sender okC: RCPT TO:<accounts@example.net>     · PTR mismatch: 203.0.113.87 has no forward-confirmed name     · DNSBL: listed on zen.spamhaus.org (127.0.0.4)     · Rate: 31 RCPTs from this IP in 60 sS: 550 5.7.1 Rejected by policy before DATA. See https://spamjadoo.com/whyC: QUITS: 221 2.0.0 Bye     0 bytes of message content accepted. 0 bytes scanned.

What is checked, and when

The sequence below is the order of an SMTP session. Each stage is a chance to refuse, and a refusal at any stage means nothing after it runs.

  1. connect

    Connection opens

    • ·Connecting IP checked against the DNS blocklists you enable
    • ·Reverse DNS fetched and forward-confirmed
    • ·Per-IP connection and rate limits applied
    • ·Known-bad and allow-listed ranges resolved from your policy

    Listed or rate-limited sources get a 550 with the reason and never reach EHLO.

  2. EHLO

    Sender introduces itself

    • ·HELO name syntax and resolvability
    • ·HELO name compared with reverse DNS
    • ·STARTTLS offered; policy can require it
    • ·Pipelining and command sequence abuse detected

    Bots that skip or fake the greeting are refused here.

  3. MAIL FROM

    Envelope sender

    • ·Sender domain must exist and accept mail
    • ·SPF evaluated against the connecting IP
    • ·Null-sender and bounce-address rules
    • ·Sender-specific rate limits and reputation

    A domain with a strict SPF that does not list the sender is rejected before any content moves.

  4. RCPT TO

    Recipient

    • ·Recipient must exist; unknown users rejected, not bounced later
    • ·Directory harvest attacks detected by invalid-recipient rate
    • ·JMail alias rules applied: who may write to this address, until when
    • ·Per-recipient class of service and quota

    Harvesting attempts are cut off after a handful of guesses. Backscatter is impossible because nothing is accepted then bounced.

  5. DATA

    Message content (only if everything above passed)

    • ·Antivirus at the SMTP layer, before the message is queued
    • ·Bayesian and rule-based content scoring
    • ·DKIM verification and DMARC alignment
    • ·Attachment and size policy

    The minority of traffic that reaches DATA is the only traffic that costs scanning time.

Why the timing changes everything

A content filter has to accept a message to judge it. That means every spam message costs the receiver bandwidth to receive, disk to hold, CPU to scan and, when the score lands on the wrong side of the line, a human to dig it out of quarantine.

A rejection during the session costs the receiver a few DNS lookups and a one-line reply. The sender's server handles the consequences: a real mail server generates a bounce for its user with the reason, and a spam bot moves on. Nothing needs to be stored, and there is no quarantine to review.

It also changes the false-positive story. Every handshake rejection is tied to a fact the sender can check: their IP is on a list, their SPF does not include that server, the recipient does not exist. The sender sees it in the bounce. Content scores give the sender nothing.

What still needs content scanning

Compromised accounts at reputable providers pass every protocol check, because the sending server really is authorised. That traffic is the reason Spamjadoo keeps an antivirus engine at the SMTP layer, Bayesian classification trained per deployment, and DKIM and DMARC verification. The difference is that these engines run on the fraction of traffic that earned the right to be read.

Policy is yours

Every check has a threshold and an action per domain, per IP range and per user. An ISP can run strict blocklist rejection for consumer mailboxes and a softer policy for a business tenant that receives mail from badly configured suppliers. See the ISP deployment page for how class of service works.

Questions people ask

What does rejecting spam at the SMTP handshake mean?

The receiving server evaluates the connecting IP, greeting, envelope sender and recipient during the SMTP conversation and answers with a permanent 5xx error before the sender is allowed to transmit the message body. The message is never accepted, stored or scanned.

Does handshake rejection cause false positives?

Fewer than content scoring does, because each rejection is tied to a verifiable fact such as a blocklist entry, a non-existent recipient or an SPF failure, and the sender receives the reason. A legitimate sender with a misconfiguration sees the error and can fix it, instead of the message vanishing into a quarantine.

Is content filtering still needed?

Yes, for the traffic that passes the protocol checks. Spamjadoo runs SMTP-level antivirus, Bayesian filtering and DKIM/DMARC verification on that remainder, which is a fraction of the original volume.

Watch it reject your spam.

A hosted trial takes an MX change. Your existing filter stays in place behind it, so the only thing that changes is how much reaches it.

Start free trial Try the free tools