Live feed

The live feed shows every message that hits MxGuard in real time. New entries appear at the top automatically — no refresh needed.

Columns explained

Column	What it means
Time	Local time the message was scanned (Europe/London).
From	SMTP envelope sender (the address used in MAIL FROM, not the visible From: header).
To	SMTP envelope recipient (the address used in RCPT TO).
Score	Final score 0.00–1.00. Colour-coded: green < 0.50, yellow 0.50–0.85, red ≥ 0.85.
Verdict	clean / tag / quarantine / reject (scanner) or rejected (SMTP-time)
Size	Message size in KB.
Subject	Message subject. MIME-encoded subjects (=?utf-8?B?...?=) are decoded automatically to readable text including emoji and non-Latin characters. A 📬 icon to the left of the subject means the message is a mailing-list subscription — see below.
Why	A compact summary of which signals fired (URIBL, gibberish_local, no_rdns, sender_rule, etc.)

📬 Mailing-list subscriptions

When MxGuard sees a List-Unsubscribe header on a message, it shows a small 📬 envelope icon next to the subject in the feed. This tells you at a glance that the message is bulk mail from a sender that should honour an unsubscribe request — newsletters, marketing campaigns, order receipts from retailers etc.

Click the row to open the detail panel. At the top you'll see a yellow Mailing list subscription banner listing every unsubscribe option the sender provided — usually one HTTPS link, often also a mailto: address. Click whichever you prefer to unsubscribe from the list.

If the sender supports RFC 8058 one-click unsubscribe (the modern standard that mail clients use for the "Unsubscribe" button shown at the top of messages), MxGuard notes this too. The link still opens in your browser rather than auto-submitting — clicking through is always your choice.

Why no auto-unsubscribe button? Clicking unsubscribe can sometimes confirm to a spammer that your address is valid (in which case you'll get more, not less, spam). For legitimate senders the unsubscribe will work; for spammers it won't. We show the option and let you decide rather than acting automatically.

Filtering

Three text-input boxes above the feed table let you narrow down what you see:

• Sender contains — substring match on the envelope-from
• Recipient contains — substring match on the envelope-to (use @yourdomain.com to scope to one domain)
• Subject contains — substring match on the decoded subject

Plus verdict buttons (clean / tag / quarantine / reject / smtp-reject) — click to toggle each on/off. Filtering is client-side and instant — no page reload.

Deep-linking via URL

The dashboard widgets pre-populate filters when they link here. You can build your own deep links the same way by appending query parameters:

• /feed?date=today — only today's messages
• /feed?verdict=clean — only clean verdicts
• /feed?verdict=quarantine — only quarantined
• /feed?verdict=reject — both scanner-rejects and SMTP-rejects
• /feed?recipient=@example.com — pre-populate the recipient filter
• /feed?sender=evil.com — pre-populate the sender filter
• /feed?subject=invoice — pre-populate the subject filter
• /feed?date=today&recipient=@example.com — combine any of them

When a date/verdict filter is active, an amber banner shows what's filtered with a clear link to remove filters.

Clicking a row

Click any feed row to see the full message detail in a side panel: full headers, all score components broken out, attachment list, and extracted URLs. From the detail panel you can:

• Mark as spam — opens a popover (see below) where you can also create a block rule. A red marked spam badge appears next to the recipient on the row. The button hides itself once clicked so you can't double-label.
• Mark as ham — opens a popover (see below) where you can also create an allow rule. A green marked ham badge appears on the row.
• Release (quarantined messages only) — deliver to the mailbox. A blue released badge appears, the row stays visible for a few seconds, then hides.
• Delete (quarantined messages only) — drop the message from the queue. A grey deleted badge appears, then the row hides.

Mark as spam / Mark as ham — the popover

Both Mark as spam and Mark as ham open the same popover with four options. Mark as spam proposes a block rule (red header); Mark as ham proposes an allow rule (green header). The sender address is shown at the top so you know exactly what you're acting on:

• Just label as spam / ham — only retrains the model, creates no rule.
• This exact address (default) — acts on person@example.com specifically. Mail from other addresses on the same domain is unaffected.
• Whole sender domain — acts on *@example.com. All future mail from any address on that domain is blocked (spam) or allowed without further scoring (ham).
• Custom pattern — free text input for cases like *@marketing.example.com (one subdomain) or wider patterns.

Scope is automatic and role-aware:

• If you're a customer, the rule applies only to mail addressed to your own domain. The server verifies the recipient domain belongs to your account before saving.
• If you're an MxGuard admin, the rule is global and affects every customer.

An italic line at the bottom of the popover tells you which scope will apply, so there's no surprise. After confirming, the status line next to the row shows what was done — e.g. labelled as spam + rule (evil.com domain:42) — or (rule already exists) if the same rule was already in place.

Cancel closes the popover without labelling the message or creating any rule. So if you click Mark as spam by mistake, just hit Cancel.

What labels actually do

Labels are recorded in verdict_overrides and used as training data when the ML model is retrained. They don't change the current model's behaviour immediately — only future mail processed after a retrain will benefit from your feedback.

Block rules created via the popover take effect immediately. The next message matching the pattern is rejected at SMTP time. See allow/block rules for how to view and manage them.

See message tagging for the full detail on labels vs rules.

Live updates

The green pulsing dot in the corner indicates the feed is live. New rows slide in automatically every few seconds. The row count and last-update timestamp keep you oriented.