Spam filter for SmarterMail: an MX gateway in front of your mail server

This page shows how to place iBlockSpam in front of a SmarterMail server. Internet mail reaches the filtering service first, and clean mail is delivered to SmarterMail. Mailboxes, webmail and user sign-ins stay as they are.

SmarterMail's interface changes between builds. Menu names below are from SmarterTools' help and knowledge base at the time of writing (October 2026), so labels in your version may differ slightly.

Placeholders used below:

• <GATEWAY-MX-HOSTS>: the MX hostnames for your domain.
• <GATEWAY-IP-RANGES>: the IP ranges the filtering service delivers from.
• <SERVER-HOSTNAME>: your SmarterMail server's mail hostname, for example mail.example.net.

The iBlockSpam setup wizard shows your exact values, a before/after DNS comparison and the rollback steps.

Prerequisites

• The SmarterMail system administrator login. Domain administrators can't change server-wide antispam or whitelist settings.
• The server has a hostname with a valid TLS certificate and accepts mail on port 25.
• Access to your DNS host, where you change the MX records.
• Access to the firewall in front of the server, for the lockdown step.
• An outside test mailbox.

Step by step

1. Add your domain in iBlockSpam. Set the delivery destination to <SERVER-HOSTNAME> on port 25. The wizard checks that it can connect.

2. Lower the MX TTL to 300 seconds at least one full old-TTL period before the cutover. Our guide to DNS TTL and MX propagation explains the timing.

3. Add an IP bypass for the filtering service. SmarterTools explains that SmarterMail normally pulls the most recent IP address from the headers, which behind a gateway is the gateway; a bypass lets it check the originating server instead (SmarterMail help: IP Bypasses). In current builds, SmarterTools' steps are: sign in as the system administrator, open Settings » Security, select the Whitelist tab, click New, set Source to IP Address, enter each range from <GATEWAY-IP-RANGES>, turn on Bypass IP for Spam Checks and save (SmarterTools KB: Sender Verification Shield and incoming gateways). Single addresses, ranges and CIDR blocks are accepted. SmarterMail's help also documents the same feature as an IP Bypasses page in the antispam settings, so the location can differ by build.

4. Keep the entry narrow. The whitelist dialog has other options, such as Bypass SMTP Authentication, Bypass Spam Checks and Bypass Greylisting (SmarterMail help: Blacklist and Whitelist). Leave SMTP authentication bypass off: the filter only delivers inbound mail. Leave Bypass Spam Checks off at first, so SmarterMail's own checks act as a second layer. Greylisting is enabled by default on new SmarterMail installs (SmarterMail help: Antispam Options); if filtered mail is delayed by it, turn on Bypass Greylisting for these ranges only.

5. Check SPF and DKIM weights. SmarterMail runs SPF and DKIM checks on all mail, including mail from IP bypasses. SmarterTools' help doesn't say which IP address its SPF check uses for gateway mail, so look at the spam headers on your test messages in step 8 before you rely on them.

6. Change MX. At your DNS host, replace the MX records with <GATEWAY-MX-HOSTS> and the priorities shown in the wizard. Do not keep SmarterMail as a backup MX: senders may use any listed MX (RFC 5321, section 5.1), and that gives spammers a direct path. Our guide on changing MX records without losing email covers the cutover.

7. Close the direct route. Removing the server from MX does not stop spammers who connect to its IP address directly. Once the old TTL has expired, and if every domain on the server is filtered, allow inbound TCP port 25 only from <GATEWAY-IP-RANGES> in the firewall in front of SmarterMail. Keep your users' submission and mail-access ports open. If some domains on the server aren't filtered, skip this step; our direct-to-server guide explains the trade-offs.

8. Test. Send messages from two outside providers and read the headers, as below.

How to verify

View a message's headers in SmarterMail webmail, or paste them into the Email Header Analyzer, which runs in your browser.

• Received: the hop just before SmarterMail should be the filtering service.
• X-SmarterMail-TotalSpamWeight, which SmarterTools' antispam help documents as the message's total spam weight: the weights shouldn't include SPF failures for legitimate senders. If they do, revisit step 5.
• Direct connection: after step 7, a connection to port 25 from any IP outside the filter's ranges should fail.

Use the MX Lookup tool to confirm the public records.

Rollback

1. Remove the port 25 firewall restriction first, so direct mail is accepted again.
2. Change MX back to the SmarterMail server, with a short TTL.
3. Keep the iBlockSpam domain active until the old TTL expires, so mail in flight through the filter is delivered.
4. Then delete the whitelist entries for the filter's ranges.

Common mistakes

• Keeping SmarterMail as a backup MX. It gives senders a way around the filter.
• Bypassing SMTP authentication for the gateway. It isn't needed for inbound mail and widens what a whitelisted address can do.
• Bypassing all spam checks on day one. You lose SmarterMail as a second layer before you know whether you need it.
• Closing port 25 on a server with unfiltered domains. Those domains stop receiving mail.
• Missing IP ranges. Every range the filtering service delivers from must be listed. The wizard shows the complete list.

Outbound mail and SPF

Nothing in this setup changes how SmarterMail sends mail, so your SPF record stays as it is (RFC 7208). Add iBlockSpam to SPF only if you later route outbound mail through the iBlockSpam outbound relay, which includes 500 messages per domain each month.

Limits

• Each domain includes 100,000 inbound messages per month and accepts messages up to 400 MB. SmarterMail's own message size limits also apply, and the smaller limit wins.
• Unlimited mailboxes means any number of mailboxes per domain, not unlimited message volume.
• Mail is spooled for up to 5 days if SmarterMail is down. Message history is kept for 30 days.
• An MX lookup can't prove mail is filtered. Headers, logs and a direct-connection test are the evidence.

Hosting providers can offer filtering across customer domains, with partner terms agreed individually; see partners and our page for hosting providers. Other platforms are on the platforms page. Stuck on a step? Our support page lists what to send so we can trace mail quickly.