Klytic

Home›Guides›Email security

Email security · Understand

Spam, phishing, malware and compromised accounts

Four different problems come through the same door. Spam is measured by volume, phishing by its credibility, malware by its attachment or link, and a compromised account writes from a real mailbox. A reputation-based anti-spam filter mainly targets the first: that is why it is no longer enough, and why a modern filter combines several signals before deciding.

Updated October 20266 minOfficial sources cited

Spam: volume

Spam is unsolicited mail sent in bulk. It is a nuisance and wastes time, but it rarely targets a specific victim.

What gives it away: the reputation of the sending server or domain, a domain created a few days ago, advertising content repeated identically to thousands of recipients. A reputation and content filter stops it well, and targeted greylisting of unknown senders weeds out part of the automated sending.

Not to be confused with graymail. A newsletter someone subscribed to or a promotion from a known supplier is not spam. Sorting them separately keeps the mailbox from being flooded without blocking an expected message.

Phishing: credibility

France’s national victim assistance service, cybermalveillance.gouv.fr, describes phishing as a fake message posing as a trusted third party (bank, government agency, supplier, social network) in order to steal usernames, passwords or banking details. Common forms in companies:

  • a fake login page for email or file sharing;
  • an imitation of a well-known brand: carrier, bank, software vendor;
  • a QR code inside an image, which moves the link from the computer to the phone;
  • a message asking you to call back a fake support number.

Domain authentication is not enough here. A fraudster who buys a lookalike of your domain can configure SPF, DKIM and DMARC perfectly for that domain: the message is authentic… for a domain that is not yours. What gives it away is the resemblance to a known brand or domain, the age of the domain, the reputation of the links and the content.

When phishing targets a specific person to obtain a wire transfer, it becomes CEO fraud: see impersonation and CEO fraud. What SPF, DKIM and DMARC actually stop is detailed in SPF, DKIM and DMARC.

Malware: the attachment or the link

The malicious program arrives in an attachment or behind a link: an Office document asking you to enable macros, a booby-trapped PDF, an HTML file imitating a login page, an archive, an image containing a QR code. The message itself can look ordinary (“your invoice”, “shared document”).

The response focuses on the file and the link: antivirus, inspection of macros and PDFs, reading of QR codes, URL reputation, then checking at the time of click. The guide attachments, links and ransomware details what is examined and what remains a human action.

Compromised account: the real mailbox

Here, the message comes from a real mailbox, belonging to a supplier, a customer or a colleague whose password has been stolen. SPF passes, the DKIM signature is valid, the sender is known. A filter that only asks “is the sender unknown or poorly authenticated?” sees nothing.

The signs lie in the behavior:

  • a regular correspondent suddenly writing to unusual recipients, or to a large number of them;
  • a tone, language or sending time that does not match them;
  • a new request: a change of bank details, an unexpected sharing link, a document “to sign urgently”;
  • a reply inserted into an old email thread to exploit its credibility.

Two situations to keep apart. When a third party’s account is writing to you, the inbound filter can spot the anomaly. When it is your own account, the issue is first and foremost one for your email system: password, two-factor authentication, sign-in alerts, forwarding rules added by the attacker. It is not the same project as external phishing, even though it often starts with phishing.

Four threats, four responses

ThreatWhat gives it awayMain responseWhat is not enough
SpamVolume, reputation, recent domainReputation and content, targeted greylistingDeleting by hand
PhishingImitated brand or domain, suspicious linkImpersonation detection, analysis of links and QR codesSPF, DKIM and DMARC alone
MalwareAttachment or linkFile analysis, time-of-click protectionA reputation-based anti-spam filter
Compromised accountChange in habits of a known senderAnomaly detection, then account securityA sender blocklist

An example, for illustration only. On the same Monday, a small business receives a wave of printer ads, a fake delivery notice with a QR code, an “invoice” in HTML format, and a message from a regular customer’s accountant announcing new bank details. The first three are a matter for the filter. The fourth comes from a real mailbox: the filter can flag the anomaly, but a call to the customer’s already-known phone number is what settles it.

How modern filtering works

A recent filter does not base its decision on a single criterion. It calculates a score from several signals:

  • sender authenticity: SPF, DKIM, DMARC, server and domain reputation, domain age;
  • the message: links, text, known scam scenarios, resemblance to a brand or an internal name;
  • attachments: antivirus, macros, PDFs, images;
  • context: the same message sent to many recipients (a campaign), or a regular sender whose behavior changes.

The score leads to a graduated decision: deliver, quarantine, reject, or defer an unknown sender. Quarantine matters as much as rejection: a legitimate message set aside by mistake must be easy to find and release, see Quarantine, false positives and reports.

User reports, “this is spam” or “this is legitimate”, then adjust sender reputation. A filter that learns from its mistakes produces fewer false positives.

Frequently asked questions

Why do we still get spam with a good filter?

Because a filter has to strike a balance between blocking too much and letting things through. A setting that lets nothing through also sets aside expected messages.

Is a message that passes DMARC safe?

No. It proves that the displayed domain authorized the sending, not that the content is honest. See SPF, DKIM and DMARC.

What should I do with a suspicious message I have already received?

Do not click, do not reply, and report it to the administrator rather than deleting it. Cybermalveillance.gouv.fr also recommends, when in doubt, contacting the organization through a channel you already know.

A colleague’s account is sending strange messages: what should I do?

Alert the email administrator, who will change the password and check two-factor authentication and forwarding rules. This is not a filter setting.

Where Klytic fits

Klytic MTA analyzes each message in layers, before the mailbox, in front of any email system.

  • Authenticity (Essential and Advanced): SPF, DKIM, DMARC including for forwarded messages, server and domain reputation, domain age, targeted greylisting of unknown senders.
  • Message (Essential and Advanced): anti-phishing, brand impersonation, lookalike domains and display names, QR codes, detection of campaigns and of unusual sender behavior, newsletter sorting.
  • Attachments (Essential and Advanced): antivirus, Office macros, PDFs; dangerous attachments removed and replaced with an informational notice. Advanced adds booby-trapped HTML files and text hidden in images.
  • At the time of click (Advanced): links are rescanned when the user clicks.
  • Financial fraud (Advanced): executive fraud, fake invoices, fake wire transfers and other scenarios.

User reports feed shared learning across instances, and messages with an ambiguous score are arbitrated by an AI model, in both plans. What this model receives is explained in AI in email filtering.

Limitation: Klytic MTA sees the mail that passes through it. The security of your own accounts (passwords, two-factor authentication, sign-ins) remains the responsibility of your email system.

Sources

Consulted in October 2026.

  • Cybermalveillance.gouv.fr, “Que faire en cas de phishing ou hameçonnage ?” (What to do in case of phishing): definition of phishing, impersonation of a trusted third party, theft of credentials and banking details, verification advice. cybermalveillance.gouv.fr
  • RFC 7489, DMARC: the mechanism does not address visually similar domains, display name abuse or content analysis. rfc-editor.org
  • Klytic, Klytic MTA page: analysis layers and modules of the Essential and Advanced plans, options, deployment modes, activation via the MX record. klytic.com

Stop what anti-spam cannot see

Free 30-day trial, in front of your current email system.

Try Klytic MTA →

See both plans

Further reading

Understand · Email securityImpersonation and CEO fraudCEO fraud targets a wire transfer, often with no malware at all. Four forms of impersonation, what a filter detects, and the check that stays human.6 min readRead →Understand · Email securitySPF, DKIM and DMARC: what they protect, and what they do notSPF, DKIM and DMARC prevent others from using your exact domain. They do not read the message: what they stop, what gets through, how to deploy them.6 min readRead →Understand · Email securityAttachments, links and ransomware received by emailWhat a filter examines in an attachment and a link, why links should be rechecked at click time, and what remains a human action or the job of backups.6 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing