The short version
- Your inbound mail is processed in the United States.
- Messages are scanned automatically. People only see quarantined mail they're entitled to see.
- Message history is kept for 30 days.
- Mail moves over TLS whenever the other server supports it.
- Admin accounts use multi-factor authentication. Customer accounts can turn on two-factor authentication (authenticator app, with single-use recovery codes), and account owners can require it for everyone on the account.
- Customers can see an account activity log (sign-ins, failed attempts, security, domain and billing events), and we email you when your password, sign-in email or two-factor settings change.
- You can leave by changing your MX records back, and we'll help you do it safely.
We don't claim SOC 2, ISO 27001 or GDPR certification. If your organization needs a specific framework, contact us before you sign up and we'll tell you honestly what we can and can't provide.
How mail flows through the service
- A sender's server looks up your domain's MX records and connects to our filtering servers.
- The filtering service checks the message for spam, viruses, malware, phishing and spoofing, and applies your rules.
- Clean mail is delivered to your mail server (for example Microsoft 365, Google Workspace or cPanel).
- Held mail goes to the recipient's personal quarantine, where they or an admin can review it.
If your mail server is unreachable, messages are held (spooled) for up to 5 days and delivered when it's back.
What data is involved
| Data | Where it comes from | Who uses it | How long |
|---|---|---|---|
| Message content in transit | Inbound mail to your domain | Filtering service, automatically | Passed through; quarantined copies follow the message history period |
| Message history (sender, recipient, subject, time, verdict) | Filtering results | You, your admins, support on request | 30 days |
| Quarantined messages | Held mail | The recipient and your domain admins | Within the 30-day history |
| Account details | You, at sign-up | iBlockSpam, for billing and support | While your account is active, then as our privacy notice sets out |
| Domain settings and DNS snapshots | Our setup wizard and monitoring | iBlockSpam, to detect drift and support rollback | While your account is active |
Our free tools read public DNS. The Email Header Analyzer runs in your browser; the headers you paste are not uploaded.
Who can see quarantined mail
- The mailbox user can see and release messages in their own personal quarantine, and receives digest emails on the schedule you choose.
- Domain admins can see the domain-wide shared quarantine and manage allow and block lists.
- iBlockSpam support: how we operate is that staff open a specific message only when it's needed to resolve a ticket you've raised, and only for that purpose.
Releasing mail safely
Releasing a message delivers it to the recipient. It doesn't automatically allow the sender forever. Adding a sender to an allow list is a separate, deliberate step, because broad allow rules are one of the most common ways phishing gets through.
Encryption
In transit: mail is sent and received over TLS when the other server supports it. This is called opportunistic TLS, and it's how most email on the internet works. If a sending server doesn't offer TLS, the message may arrive unencrypted on that hop. That's a limit of email, not something any gateway can fully fix for senders it doesn't control.
The portal: all access to iBlockSpam's website and portal uses HTTPS.
Accounts and access
- Administrator accounts use multi-factor authentication.
- Access inside the portal is scoped by role: a mailbox user can't see another user's quarantine.
- Our own staff access is limited to what's needed to run and support the service.
Backups and resilience
We back up our own systems (accounts, settings and DNS snapshots) separately from the servers that run them. We don't publish recovery-time figures until we've tested and can stand behind them.
For your mail, outage spooling holds inbound messages for up to 5 days if your mail server is down. That protects against your server being unavailable; it's not an archive. See outage spooling.
Leaving iBlockSpam
You stay in control of your DNS. To leave:
- Point your MX records back to your mail platform (or to your next provider).
- Wait for the old records' TTL to expire and confirm mail arrives directly.
- Remove any inbound connector or gateway setting you added for iBlockSpam.
- Tell us, and we'll close the service only after mail has stopped routing through us.
Our migration guide covers each step, including rollback.
Reporting a vulnerability
Email security@iblockspam.com. Please include what you found, where, how to reproduce it and how to reach you. Test only against your own account, don't access other people's data, and don't run denial-of-service or spam-volume tests. We'll acknowledge your report and work with you on a fix.
Questions
For security reviews or supplier questionnaires, contact us. We'll answer with what's true today, and tell you when something is planned rather than live.
Frequently asked questions
Can iBlockSpam staff see our email?
No one at iBlockSpam reads your mail as a matter of course. Messages are scanned automatically by the filtering service. Your users see their own quarantine and your admins see the shared quarantine. Our support team only looks at a specific message when you ask us to help with it.
Where is my email processed?
Mail is processed in the United States. Inbound messages pass through our filtering infrastructure, operated with a US-based filtering subprocessor, before clean mail is delivered to your own mail server. If you have data-residency requirements, check them before you change your MX records.
Do you hold any security certifications?
Not at this time, and we won't imply otherwise. Instead we describe our actual controls on this page: MFA for admin accounts, encryption in transit where the other server supports it, scoped access to quarantine, and backups of our own systems. Ask us if you need more detail for a supplier review.
How do I report a vulnerability?
Email security@iblockspam.com with a description, the affected URL or component, steps to reproduce and your contact details. Please don't access other customers' data, run denial-of-service tests or send spam to test the filter. We'll acknowledge your report and keep you updated while we investigate.
Related guides
Email security checklist for small businesses in 2026
A practical 2026 email security checklist for small businesses: MFA, SPF, DKIM and DMARC, filtering, backups, staff training and an incident plan.
9 min read SPF, DKIM & DMARCMTA-STS and TLS-RPT explained: how to set them up safely
What MTA-STS and TLS-RPT protect against, the DNS records and policy file you need, testing vs enforce mode, and safe rollout behind a filtering gateway.
9 min read Email security basicsWhat is an email quarantine, and how should you use it?
What an email quarantine is, personal vs admin quarantine, digest emails, retention limits, and how to release messages without letting phishing back in.
8 min readLast updated: