Klytic

Home›Guides›Email security

Email security · Use Klytic MTA

Who sets the filter in Klytic MTA

Klytic MTA filtering is set at five tiers, applied in a fixed order: network and country, domain sender rules, trusted entities, domain fraud context, then each user’s personal lists, last. Each tier has its own owner: the platform operator, the domain administrator or the user. None of them requires a Klytic Mail mailbox.

Updated October 20265 minHow-to Klytic MTA

Three roles

  • The operator runs the platform. In the Klytic cloud and on a dedicated instance, that is Klytic. For an installation on your own servers, the split of operating tasks is agreed at setup.
  • The domain administrator is the person your company designates for one or more domains: often your IT manager or your service provider.
  • The user receives the mail. They release their quarantined messages and maintain their personal lists.

The five tiers, in order

TierWho sets itWhat it contains
1. Network and countryThe operatorRules based on the network or geographic origin of connections.
2. Domain sendersThe domain administratorBlock a sender, allow it, or let it through without filtering, for the whole domain.
3. Trusted entitiesThe operatorOrganizations the filter treats as trusted across the whole platform.
4. Domain fraud contextThe domain administratorThe names of executives and managers, regular suppliers: what makes it possible to recognize a message impersonating them.
5. Personal listsThe userTheir allow list and block list, applied last.

Each tier has its own scope. A personal list does not override a domain rule: if a sender must be received by everyone, the administrator sets the rule. A sender rule does not replace the fraud context: allowing a supplier’s domain does not tell the filter who your CFO is.

Domain sender rules

The domain administrator has three options:

  • block a sender or a domain you no longer want to receive anything from;
  • allow a legitimate sender that the filter wrongly holds, after verification;
  • bypass the filter, that is, not analyze its messages at all.

Reserve the third option for cases where it is essential. A sender exempted from filtering remains exempted the day its account is hacked. And a compromised account sends real messages, properly signed, from a real mailbox: exactly what the analysis still needs to see. See Spam, phishing, malware and compromised accounts.

For one-off false positives, releasing from quarantine is often enough: see Quarantine, false positives and reporting.

The domain fraud context

Only your company knows who is in charge, who approves payments and which suppliers it works with. That is why this context is maintained by the domain administrator, not by the operator. It lets the filter spot a message that uses your CEO’s name from an external address, or that imitates a real supplier to announce a change of bank details.

Keep it up to date: when a new executive arrives, when a CFO leaves, when a major supplier changes.

Detection of CEO fraud and financial fraud is part of the Advanced plan. Essential already detects lookalike domains and display-name spoofing. How these frauds unfold, and the checks that remain human, are described in Impersonation and CEO fraud.

Enabling or disabling a detector

Klytic MTA brings together many specialized detectors. They are enabled for the instance, then configured domain by domain. You can therefore apply different settings to two domains protected by the same gateway, for example the parent company’s and a subsidiary’s.

The domain administrator asks Klytic to enable, disable or adjust a detector for their domain, within the scope of the subscribed plan: an Advanced plan detector is only available if that plan is subscribed. Details of both plans are on the Klytic MTA page.

Graymail: newsletters and promotions

A newsletter someone subscribed to is not spam. Klytic MTA recognizes newsletters and promotions and can, depending on each domain’s settings, tag them or file them separately, instead of treating them as unwanted messages.

The category appears in the message’s X-KlyticMTA-Category header. Filing into a folder is done in the receiving email service: most let you write a sorting rule on a header. Reading headers is explained in Reading and exporting a filter decision.

Example: a group of two companies

A group protects two domains with Klytic MTA: the holding company’s, on Microsoft 365, and an industrial subsidiary’s, on another server. Klytic operates the platform and maintains the shared tiers: network and country, trusted entities. The group’s IT manager administers both domains. For the holding company, she enters the chairman and the CFO in the fraud context. For the subsidiary, she blocks a former contractor and chooses to file newsletters separately. A salesperson at the subsidiary adds a trade show that often writes to him to his allow list. Each person acts at their own tier, without touching anyone else’s.

Without Klytic Mail

None of these steps requires a Klytic Mail mailbox. The rules apply in the gateway, before delivery, whatever email service then receives the mail. See Protecting the email system you already have.

Frequently asked questions

Can a user receive mail from a sender the domain blocks?

Their personal list does not override a domain rule. They should contact the administrator. See also Quarantine, false positives and reporting.

Do the rules apply to outgoing mail?

The send delay and signing are also set per domain. See DKIM signing, S/MIME signing and recalling outgoing mail.

Who updates the fraud context when an executive leaves?

The domain administrator. What is at stake is described in Impersonation and CEO fraud.

How can I tell which rule applied to a message?

The reason for the decision is in the headers. See Reading and exporting a filter decision.

Adjust your domain’s rules

Klytic support helps you enable or adjust a detector, and fill in your domain’s fraud context.

Contact support →

The Klytic MTA offer

Further reading

Use · Email securityQuarantine, false positives and reportingWhat happens to a message held by Klytic MTA, how to release it, correct a false positive and report a malicious message.6 min readRead →Understand · Email securityImpersonation and CEO fraudCEO fraud targets a wire transfer, often with no malware at all. Four forms of impersonation, what a filter detects, and the check that stays human.6 min readRead →Use · Email securityDKIM signing, S/MIME signing and recalling outgoing mailDKIM-sign outgoing mail, S/MIME-sign it if your email service does not, and catch a message sent too hastily.5 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing