Does xmail block scam senders automatically?

No. You get a warning on the message with the reasons behind it, and you decide what to do. xmail does not blacklist a sender for you and does not claim to have saved you money.

Does this work on a free account?

Partly. Sender authentication, reputation checks and rule-based filtering run on every account, free ones included. The step where a model reads the text of the message and names what the sender is trying to do comes with a paid name.

Can I rely on the verdict completely?

No, and we will not pretend otherwise. A well-made scam can pass the checks and a legitimate message can be flagged. Treat the verdict as a second opinion that arrives before you open the message.

How xmail spots a scam

A good scam does not look like spam. It looks like the invoice you were expecting, from the supplier you actually use, with one line changed: the bank account. This page explains what xmail checks before you see such a message, what it shows you, and what it deliberately does not do.

The short answer

Three independent things are checked: whether the sender is who the message says it is, what is known about that sender, and — with a paid name — what the text is actually trying to achieve.
The result is a warning on the message with the reasons for it. You are the one who decides.
Nobody is blocked for you, and we do not count money you supposedly saved.
In the thirty days to 20 October 2026 the service produced 6 527 analyses that carried scam signals, 2 437 of them scoring 700 or more out of 1 000.

First: is the sender who it claims to be

Every incoming message is checked for SPF, DKIM and DMARC alignment — the three standards that let a domain owner say which servers may send on its behalf and let us verify that the message was not altered on the way. The result is shown to you rather than hidden, because it is the one piece of evidence that is either there or not.

On its own it proves less than people think. A scammer can register a brand new domain and pass all three checks perfectly. Authentication tells you that the sender controls the domain it used; it does not tell you that the domain is the one you think.

Second: what is known about this sender

Before any model is involved, the message is scored against what is known: reputation of the sending address and the account's own history with it, public blocklists, the sending infrastructure behind the message, the age and registration of the domain it came from, and a long list of rules — a scale from 0 to 1 000. A statistical model trained on earlier decisions adds its own opinion, by comparing the message with mail that has already been judged. All of this runs on our own servers, on every account, free ones included, and it ends most of the work.

Third: what the message is trying to do

A paid name adds the step that matters for targeted fraud: our own language model, running on our own GPUs, reads the message and names the intent. Links are shortened to their bare domain first, so a disguised address cannot carry meaning it does not have. What it looks for, among other things:

payment details that changed, or that do not fit the sender;
someone writing as a person or a company you know, from somewhere they do not write from;
a page that wants a password, a code or a document, dressed as a service you use.

What you see

A message that worries the system arrives with a band on it — red for something that looks like outright fraud, yellow for something that needs a second look — together with what triggered it: the signals that were found, in plain words, and the result of the authentication check. A warning you cannot see the reasons for is just an interruption.

What this protection does not do

It does not block, blacklist or delete a sender on your behalf, and it does not quietly remove a message from your mailbox. It does not calculate what a scam would have cost you — any site that shows you that number is showing you a marketing illustration.

And it is not a guarantee. The chain is good at ordinary cases and at mechanical signals; a careful, well-researched attack aimed at you personally can still read as legitimate. When a message asks for money, a password or a change of bank details, confirm it through a channel you already had — a phone number you knew before the message arrived.

If something got through

Do not reply to it and do not open its attachments. Tell us at [email protected]: a real example of a scam that passed the checks is the most useful thing we receive.

Questions and answers

Does xmail block scam senders automatically?: No. You get a warning on the message with the reasons behind it, and you decide what to do. xmail does not blacklist a sender for you and does not claim to have saved you money.
Does this work on a free account?: Partly. Sender authentication, reputation checks and rule-based filtering run on every account, free ones included. The step where a model reads the text of the message and names what the sender is trying to do comes with a paid name.
Can I rely on the verdict completely?: No, and we will not pretend otherwise. A well-made scam can pass the checks and a legitimate message can be flagged. Treat the verdict as a second opinion that arrives before you open the message.