About Spam Scanner

Spam Scanner is an email spam filter made by Forward Email, the privacy-focused email service, which built it for its own mail servers. The source code, issues and releases are on GitHub, and the package is on npm.

Who makes it#

The Forward Email team writes and maintains Spam Scanner. Forward Email keeps no logs of message content, so it could not send mail to an outside filtering service: the filter had to run on its own servers and explain each decision without a person reading the mail. How Forward Email uses it

Forward Email is open source as well, at github.com/forwardemail/forwardemail.net. Its founder was one of the first employees at DuckDuckGo.

Contact#

Questions, bugs and feature requests: open an issue on GitHub.
Security vulnerabilities: report them privately through GitHub's vulnerability reporting, not in public issues. The same address is in security.txt.
Other licensing: contact Forward Email.

License terms#

Spam Scanner's license is the Business Source License 1.1, with the Apache License 2.0 as its Change License. The Change Date named in the license has passed, and from that date the license grants you rights under the Apache License 2.0.

Privacy#

This website sets no cookies and loads no analytics, trackers, ads, fonts or scripts from other sites. Every file comes from spamscanner.net.

The theme, the language you choose and the Mastodon server you share to are saved in your browser's local storage, and never sent anywhere.
The video loads only when you play it.
The share links are plain links, so nothing from those networks loads until you follow one.
The site is hosted on GitHub Pages, and GitHub logs the IP address of each visitor for security purposes. See GitHub Pages and the GitHub General Privacy Statement.

What the software sends#

Spam Scanner sends no telemetry and checks for no updates. By default it looks up the host names of links in a message on Cloudflare's filtering DNS resolvers, and nothing else leaves the machine. Its other network checks are off until you turn them on. Security and privacy

Releases#

The standalone binaries are built by GitHub Actions from the public repository. Each release lists their hashes in a SHA256SUMS file, which the install script checks, and each binary carries a signed build provenance attestation. Releases and their notes are on GitHub.

Guides

Postfix spam filterFilter spam on a Postfix server with Spam Scanner's milter or content filter: setup, systemd unit, rejecting with 4xx or 5xx, and a Junk folder.

SpamAssassin alternativeReplace SpamAssassin's spamd with Spam Scanner. spamc, Exim and Haraka keep working, the X-Spam headers keep their names, and every language is supported.

Self-hosted spam filterRun a spam filter on your own server. Spam Scanner keeps mail on the machine, ships its model in the package, sends no telemetry and plugs into Postfix or Exim.

AI spam filterCatch spam and phishing that rules miss with a language model: Ollama on your own server, Cloudflare Clef, or Claude and ChatGPT, asked only about close calls.

Multilingual spam filterHow Spam Scanner filters spam in every language: Unicode word segmentation, undoing disguises, and never flagging a language the model knows little about.

Phishing detectionHow Spam Scanner detects phishing email: Unicode lookalike domains, links that show one address and go to another, brand display names, Cloudflare's malware resolver and DMARC.

Node.js spam filterScan email for spam, phishing and malware from Node.js: one npm package with a trainable classifier, ESM and CommonJS, smtp-server integration and typed results.