Subscription Bomb Detection in Email Gateway Defense

Subscription Bomb Detection will be available to customers in an upcoming release. This article describes how the feature will work once it is enabled for your account.

Email Gateway Defense (EGD) uses machine learning to detect and mitigate subscription bomb attacks. A subscription bomb attack (also called subscription bombing or email bombing) floods a recipient's mailbox with hundreds or thousands of confirmation emails from legitimate services, overwhelming their inbox and burying important messages like fraud alerts, password resets, or business communications.

When a burst of confirmation-style mail from many distinct senders targets a single recipient, the machine learning classifier identifies the attack pattern and takes action to keep the mailbox usable while allowing legitimate mail to continue flowing.

The detection is automatically enabled for all Email Gateway Defense customers and works at the MX path to prevent flood messages from reaching the inbox.

How Subscription Bomb Detection Works

Subscription bomb detection uses a two-step process. Both steps must agree before any action is taken.

Step 1: Volume monitoring

Email Gateway Defense tracks how quickly messages arrive for each recipient. Only messages that have already passed all other inbound checks are counted; messages blocked as spam, by reputation, or by your policies are not included in the count.

The system monitors five-minute intervals. When the busiest interval in the last ten minutes crosses the threshold for that recipient, the mailbox is flagged as potentially under attack.

No messages are blocked at this point. A burst of mail alone does not indicate an attack. Many mailboxes legitimately receive high volumes for short periods. For example, an event registration address after a newsletter is sent, or a support alias during an outage. Volume alone cannot distinguish these from a subscription bomb attack.

Step 2: Machine learning classification

While a mailbox is flagged, each arriving message is scored individually by a machine learning model trained to identify signup and confirmation emails. Only messages that the model identifies as part of the attack receive the action you configured for Subscription Bomb Detection (Block or Quarantine). All other messages are delivered normally.

This means legitimate mail – such as invoices, password resets, and messages from your customers – continues to arrive even while the attack is ongoing.

The feature is always on. You can configure the action (Block or Quarantine), but you cannot disable subscription bomb detection.

Available Actions

You can configure how Email Gateway Defense handles messages identified as subscription bomb attacks:

Block (default) – Rejects the message at SMTP. Blocked messages are never stored and cannot be previewed or delivered. This is the recommended action to prevent mailbox flooding.
Quarantine – Holds the message in quarantine where you can review and release it if needed.

Configuring the Action in Email Gateway Defense

To configure the action for subscription bomb messages:

In Email Gateway Defense, go to Inbound Settings > Machine Learning.
In the Subscription Bomb Detection section, select either Block or Quarantine.

Subscription Bomb Detection Across Products

The Subscription Bomb Detection setting is shared between Email Gateway Defense and Email Protection. When you configure the action in one interface, it automatically applies to both products.

You can access and modify this setting from either location:

Email Gateway Defense: Inbound Settings > Machine Learning (this page)
Email Protection: Policies > Threats > Subscription Bomb

Changes made in either location take effect immediately in both interfaces.

Exempting Senders from Machine Learning Classification

If you need to exempt specific senders from subscription bomb detection, you can add them to the machine learning exemption list on the Inbound Settings > Machine Learning page.

Important: When you add a sender to the machine learning exemption list, that sender is exempted from all machine learning classification, not only subscription bomb detection. This means messages from that sender will also bypass machine learning spam, phishing, and other threat detection.

The exemption list is shared across Email Gateway Defense and Email Protection. Exemptions added in either interface apply to both products.

Only exempt senders you fully trust.

To add an exemption:

On the Inbound Settings > Machine Learning page, scroll to the exemption list section.
Add the email address or domain you want to exempt.
Click Add.

Viewing Subscription Bomb Messages in the Message Log

Messages identified as subscription bomb attacks appear in the Message Log with the reason code Subscription Bomb. You can filter the log to view these messages:

Go to the Message Log.
Use the Reason dropdown filter and select Subscription Bomb.

Blocked messages show an action of Blocked in the log. Because blocked messages are rejected at SMTP and never stored, they cannot be previewed or released from the Message Log.

Best Practices

Review subscription bomb detections regularly to ensure legitimate burst senders (such as event registration services) are not being blocked.
Keep exemptions as specific as possible. Exempt individual email addresses rather than entire domains when possible.
Monitor the Message Log for subscription bomb reason codes to identify patterns and potential attacks.