Where a message lands depends on who sent it. Mail from people in your contacts, and from people you've written to, goes to the Inbox. Mail from strangers waits in Unknown Senders, where Add to Contacts... makes a stranger a contact. Bulk mail goes to Newsletters, and what Spam Watch recognizes, or what you've marked as spam, goes to Spam. This page is the contact book, the Mark as Spam question, the Spam basket and how long spam is kept. Every rule here is one you can predict, because predictable beats clever.

How Mail Finds Its Basket

Each message is judged as it's collected, by rules taken in a fixed order, and the first one that is sure settles it:

1. Your own word. Anything you put in a basket by hand with Move To or Not Spam stays there.
2. Your allowed list, which is made of senders you've rescued.
3. Mail that says it's from you, or from nobody, is judged on its own terms (below).
4. A contact, or somebody you've written to, goes to the Inbox.
5. What you've taught: senders, domains, lists and phrases you marked as spam.
6. A real government's mail is let in.
7. Then Spam Watch adds up points for what spam looks like. Five points sends a message to Spam. Fewer leaves a stranger in Unknown Senders to be looked at; nothing is ever moved to Spam on a hunch of a point or two.
8. Whatever is left: if somebody vouched for it, the Inbox; if it's a stranger's bulk mail, Newsletters; any other stranger, Unknown Senders.

A Check Mail sorts everything again against these rules, so changing your mind in one place, such as adding a contact, is carried through the rest of the mailbox.

Contacts

Your contacts are a folder, Contacts, in the PIM folder beside Mail, with one file for each person, in the vCard format that every phone and mail program can read. A basket—Family, Medical, whatever you like—is a folder inside it. Open the Contacts folder and it's the ordinary folder listing, with the baskets as tabs along the top: All first, which lists every card with a Basket column, and then one tab for each basket. The columns are name, categories, phone, email and organization, with the contact's photo as its icon, and there's a search box on the bar that narrows whichever tab you're on. You type over a cell to change it, the way you'd rename a file, and Move To puts a contact in another basket. Right-click a tab to make a new basket, rename one or delete one. Anything more—a second phone number, an address, a birthday, a note, a link to another contact—is on a contact's own sheet, whose photo takes a picture dropped on it.

A book with nothing in it offers to bring in your Google contacts, and any vCard file dropped on the listing is merged in. Bring In Pictures, on a contact's menu or a tab's, copies pictures that are only on the web into the cards, so they show without the network.

A Contact Vouches

Mail from an address on one of your contact cards goes to the Inbox, unless Spam Watch finds a scam in it; a contact card doesn't excuse a message from being read. The match is the whole address, exactly, ignoring capitals: no guessing from names, and no matching on the part after the @. And a card doesn't vouch for mail that the server which received it says was forged. Nor does a card for your own address vouch for mail claiming to be from you. I learned that one the hard way, when six "YOU GOT RECORDED!" messages, from my own address to my own address, sat in my Inbox because my own card had waved them through. A contact card is not evidence of origin.

People you've written to count the same way, with no card needed. If you have sent a message from this mailbox to an address, and it really went, that address's answer goes to the Inbox, with the same limits: the exact address, never your own, never mail the server says was forged. Delete the message from Sent and the introduction is forgotten.

Strangers

Unknown Senders was my idea, and the reason for it is simple: if a new person writes, I want to see them, and add them to my contacts. A message from a stranger offers Add to Contacts..., which opens a card already filled in from the message; if there's already a card with that name, it asks whether to add the address to it or make a new one. A message from someone you already know offers Edit Contact... instead. Pick out several messages and Add Senders to Contacts... asks one question, listing who: "Their mail already here moves to the Inbox, and what comes later goes there."

The contact book is the authority, wherever it's changed: a couple of seconds after it changes, mail is sorted again, and anything in Unknown Senders that now has a voucher moves to the Inbox. A Check Mail does that on demand, and more: it looks through all the mail again—people you know to the Inbox, scams and spam to Spam, newsletters to Newsletters—and clears away out-of-date newsletters and old spam, saying what it's doing as it goes.

Spam

The Mark as Spam Question

Mark as Spam... is on a message's right-click menu, on the spam tin of the folder's bar (lit when one message is picked) and on the spam tin of an open message, in the Inbox, Unknown Senders and Newsletters. It doesn't just move the message, because moving a single message solves nothing: the same sender writes again. It asks how to recognize messages like it from now on, with check boxes, so one mark can say several things at once:

• This sender: that exact address. It's ticked to begin with, since it's the safest, and it's one click to leave it.
• Anyone at the sender's domain. This one and This sender exclude each other: ticking one unticks the other.
• Anything from this mailing list, when the message came from one.
• This word or phrase in the subject or the sender's name. A scammer who speaks as a company ("Harbor Freight Care") changes the address and the domain with every message and never the name, so the name is read too.
• This word or phrase in the message text (at least four characters, because a shorter one would catch too much), looked for in the text and in its links.

A sentence at the bottom says in words what everything you've ticked will do. On an open message, whatever you had selected goes in for you: words selected in the message's text fill the text box and tick it, and words selected in the subject or sender line above fill the subject box and tick it. Press OK and the message goes to Spam, and the rules go back through the mail already in the Inbox, Unknown Senders and Newsletters, sparing your contacts and anything you've rescued. If a mail check is running, you're told to try again in a moment, and while the question is open no check begins behind it.

Taught rules are kept beside the mail, in a plain file in the mailbox's folder, so they travel with it. A sender or domain you name is final for strangers; a phrase counts heavily but not absolutely. A contact, or a sender you've rescued, still gets through whatever you taught, because mistaking a friend for spam is the costlier mistake, and when that's the case the program says so after you mark one.

Not Spam

Not Spam, in the Spam basket, moves a message back to the Inbox and takes back the rule that caught it, which is the difference between a correction and a chore repeated every week. The sender's other mail waiting in Unknown Senders or Newsletters comes with it, and what they send next is let in. No rule taught later will move that message back to Spam.

The Spam Basket

In the Spam basket the trash can on the bar is lit even with nothing selected, and pressing it deletes every message there, to the Recycle Bin: spam is emptied, not picked through. It's that way in the Spam basket only. Everywhere else, the Delete key and the trash can need something picked out.

How Long Spam Is Kept

Spam is cleared away on its own once it has been kept 24 hours. The number is set for each mailbox in Set Up Email (open Mailbox Settings..., then Spam Watch: "Keep spam for N hours, then delete it"), and 0 means as soon as it's allowed. The hours count from the later of when it arrived and when it was put in Spam. It happens at the end of every mail check, and quietly whenever you open a basket (not more often than every five minutes). What's cleared goes to the Recycle Bin.

There's one safety rule above all of it: only mail the host has already let go of is cleared, or the next check would simply collect it again. So this works for a mailbox that moves mail from the host, and with Copy from host nothing is cleared at all.

Spam Watch

Beyond your own rules, Spam Watch looks for what spam looks like. Each sign adds a few points, none of them condemns a message alone unless it's an outright forgery, and it takes five to reach Spam:

• It believes only the verdicts of the server that actually received the message, not the claims a message makes about itself on the way.
• Mail that says it's from your own address, and isn't, is spam. So is mail that names no sender at all.
• The wording of extortion, together with a valid Bitcoin address, marks a scam.
• Too many strangers on one message: a note sent to a crowd of addresses nobody has heard of is a harvested list. The limit is 20 by default (0 turns it off), unless you know 75 percent or more of the people on it. Mail to "undisclosed recipients", and subjects that answer a request nobody made ("Regarding your request"), count too.
• A sender whose address is a lookalike for one you deal with, such as zeroes standing in for the letter O, counts against it.
• A domain registered in the last month or so, a cheap domain ending, and no way to unsubscribe from what claims to be a mailing all count against a message. Finding a domain's age means asking the public registry, once for each domain.
• Strangers whose message the host found neither an SPF record nor a DKIM signature for, or that the host's own spam test scored 5 or more, get two points each. Neither is a verdict. Together with something else they can tip a message over; alone they leave it in Unknown Senders to be looked at.
• An automatic answer, passed on by a mailing list, to something you never sent.
• Links are checked against a list of phishing sites from OpenPhish, downloaded once a day and checked here, so no link from your mail is ever sent anywhere to be looked up.
• Mail from a real government, whose domain the host confirms it came from, is the opposite: it's let in, however much it looks like a mailing list.

Several of these are switches in Set Up Email under Spam Watch: mail from your own address, Bitcoin addresses, domain age, the phishing list, and how many strangers is too many.

Newsletters

Bulk mail, the kind sent out to a mailing list, goes to its own basket, Newsletters, while receipts and other transactional mail stay where they'd otherwise go. Newsletters keep themselves tidy: from each sender, the older issues are replaced by the newest. In Set Up Email that's Replace yesterday's newsletter with today's, on by default, with a number saying how many of each to keep: 1 keeps only the latest, and 0, the default, keeps all of the newest day's, because some senders send several editions a day. A newsletter is one name from one site, whichever of the site's addresses it came from.

Like spam, only mail the server has already let go of is cleared, or the next check would just collect it again; with Copy from host, nothing is cleared at all. And what is cleared goes to the Recycle Bin, never straight into oblivion, because a deletion that cannot be undone is not what clearing up a mailbox is for. A newsletter you want kept forever can be moved to a folder outside the mailbox, or to the Inbox, where nothing replaces it.

Not Yet

• Leaving a recognized scam uncollected on the server, rather than collecting it into Spam.
• More phishing lists than OpenPhish's.
• A way to teach the newsletter tidy by hand.
• Noticing when a contact's address changes, for the mail that was vouched for under the old one.
• Clearing old spam and replaced newsletters from a Gmail mailbox, which waits for Desktop Minder to learn that Gmail has dropped its copy.