---
title: Deployment runbook
description: How the filters were put in place, step by step, and why each step is what it is.
icon: ListChecks
verified: 2026-08-18
---

The procedure that produced the
[current configuration](/docs/it/email/current-configuration). It is kept after
execution because the reasoning behind each step is what tells a future operator
whether a step can be changed.

Everything happens in
[Global Email Filters](/docs/it/email/global-email-filters), one step at a time,
each verified before the next.

## The constraint that shaped everything

In a *global* filter, cPanel refuses `Redirect to Email` toward any address on a
domain the account controls, it warns about recursive delivery. The quarantine
therefore **cannot** be a `quarantine@advmfr.net` mailbox.

What works instead is `Deliver to Folder`: matched mail lands in a folder of the
**system account** `sc6mixq8738`. That folder is the central quarantine. Every
other decision below follows from this one.

<Steps>

<Step>

### Create the folder

<CpanelPath steps={['Email Accounts', 'System Account', 'sc6mixq8738', 'Check Email']} />
→ Roundcube → Settings → Folders → **Create**, top level, named exactly
`Quarantine`.

</Step>

<Step>

### Delete the `X-Spam-Flag: YES` filter

Delete it outright.

It bounced a failure notice to the sender of every detected spam. Since spammers
forge their sender address, those notices went to innocent third parties,
backscatter, which damages the server's reputation. The per-mailbox Spam folder
already sorts those messages, so nothing is lost by removing it.

</Step>

<Step>

### Convert the attachment filters to quarantine

On `Executables & scripts`, then on `EXEC`: **Edit**, leave the rules untouched,
and change the action from `Fail With Message` to **`Deliver to Folder`** →
Browse → the system account's `Quarantine` (the path ends in `/mail/.Quarantine`).

Same reasoning as the previous step: `Fail With Message` is what generates
backscatter.

</Step>

<Step>

### Create the score filter

Create a new filter named `10-quarantine-score10`.

- Rule: **`Spam Bar`** · **`contains`** · exactly ten plus signs, `++++++++++`
- Action: **`Deliver to Folder`** → `Quarantine`

<Callout type="warn">
  Not `Discard Message`. That switch happens at the last step, and only after seven
  clean days. A rule that deletes before it has proven itself is how legitimate mail
  disappears without trace.
</Callout>

</Step>

<Step>

### Create the whitelist

Create `00-whitelist-critical`, rules OR-joined, one `From contains @domain` line
per critical sender, action **`Stop Processing Rules`**. Then use the arrows on
the filter list to move it to **position 1**.

Position 1 is the whole point: filters run top to bottom, so a whitelist placed
anywhere else runs after the rules it exists to override.

**Still blocked** on the list of critical domains: bank, accountant, key clients,
monitoring, the host.

</Step>

<Step>

### Set up DMARC reporting: in-house

Reports stay on the account: `rua` points at a local mailbox and a local script
digests the XML weekly. No third-party DMARC service, no data leaving.

**Create the mailbox**: `dmarc@advmfr.net`, quota 1024 MB. Its password goes into
a local `.env`, never into documentation.

**Publish the record**: <CpanelPath steps={['Zone Editor', 'advmfr.net']} /> → the
`_dmarc` TXT record. cPanel opens a dedicated DMARC form; fill exactly one field
and leave every other setting on its default.

| Field | Value |
|---|---|
| Policy | None: default, leave |
| Subdomain policy | None: default, leave |
| DKIM / SPF mode | Relaxed: default, leave |
| Percentage | 100: default, leave |
| **Send aggregate mail reports to** | `mailto:dmarc@advmfr.net` |
| Send failure reports to | **empty** |

Failure reports are left empty deliberately: they can carry message content, which
is not something to have arriving in a mailbox nobody reads.

</Step>

<Step>

### Verify

Three tests, and one trap.

1. **The built-in Filter Test** on a sample message.
2. **A control message** from an external mailbox: normal delivery, untouched.
3. **[Track Delivery](/docs/it/email/track-delivery)**: both test messages visible
   with the expected outcome.

The trap: a test message crafted to score absurdly high never reaches the account
at all. o2switch's upstream layer rejects it at SMTP time, the sender gets a
`550` and it does not even appear in Track Delivery. Such a test validates the
upstream layer and says nothing about these filters. Real malware waves score
around 43, pass the upstream layer, and must land in `Quarantine`.

</Step>

<Step>

### Graduate the score rule

After seven days with zero false positives, earliest 21 August 2026, the
score-10 rule switches from `Deliver to Folder` to permanent deletion. Only if the
observation supports it.

</Step>

</Steps>