Subscription Bomb Detection

Subscription Bomb Detection will be available to customers in an upcoming release. This article describes how the feature will work once it is enabled for your account.

A subscription bomb attack (also called subscription bombing or email bombing) floods a recipient's mailbox with hundreds or thousands of confirmation emails from legitimate services, overwhelming their inbox and burying important messages like fraud alerts, password resets, or business communications.

Email Protection uses machine learning to detect and mitigate subscription bomb attacks before they reach your users' mailboxes. When a burst of confirmation-style mail from many distinct senders targets a single recipient, the machine learning classifier identifies the attack pattern and takes action to keep the mailbox usable while allowing legitimate mail to continue flowing.

The detection is automatically enabled for all Email Protection customers and works at the MX path through Email Gateway Defense to prevent flood messages from reaching the inbox.

How Subscription Bomb Detection Works

Subscription bomb detection uses a two-step process. Both steps must agree before any action is taken.

Step 1: Volume monitoring

Email Gateway Defense tracks how quickly messages arrive for each recipient. Only messages that have already passed all other inbound checks are counted; messages blocked as spam, by reputation, or by your policies are not included in the count.

The system monitors five-minute intervals. When the busiest interval in the last ten minutes crosses the threshold for that recipient, the mailbox is flagged as potentially under attack.

No messages are blocked at this point. A burst of mail alone does not indicate an attack. Many mailboxes legitimately receive high volumes for short periods. For example, an event registration address after a newsletter is sent, or a support alias during an outage. Volume alone cannot distinguish these from a subscription bomb attack.

Step 2: Machine learning classification

While a mailbox is flagged, each arriving message is scored individually by a machine learning model trained to identify signup and confirmation emails. Only messages that the model identifies as part of the attack receive the action you configured for Subscription Bomb Detection (Block or Quarantine). All other messages are delivered normally.

This means legitimate mail – such as invoices, password resets, and messages from your customers-- continues to arrive even while the attack is ongoing.

The feature is always on. You can configure the action (Block or Quarantine), but you cannot disable subscription bomb detection.

Available Actions

You can configure how Email Protection handles messages identified as subscription bomb attacks:

Block (default) – Rejects the message at SMTP. Blocked messages are never stored and cannot be previewed or delivered. This is the recommended action to prevent mailbox flooding.
Quarantine – Holds the message in quarantine where you can review and release it if needed.

Configuring the Action

To configure the action for subscription bomb messages:

In Email Protection, go to Policies.
In the left sidebar under Threats, click Machine learning exemptions.
For Block emails detected as Subscription Bomb, select either Block or Quarantine.

Subscription Bomb Detection Across Products

The Subscription Bomb Detection setting is shared between Email Protection and Email Gateway Defense. When you configure the action in one interface, it automatically applies to both products.

You can access and modify this setting from either location:

Email Protection: Policies > Threats > Subscription Bomb (this page)
Email Gateway Defense: Inbound Settings > Machine Learning

Changes made in either location take effect immediately in both interfaces.

Exempting Senders

If you need to exempt specific senders from subscription bomb detection, you can add them to the machine learning exemption list.

Important: When you add a sender to the machine learning exemption list, that sender is exempted from all machine learning classification, not only subscription bomb detection. This means messages from that sender will also bypass machine learning spam, phishing, and other threat detection.

The exemption list is shared across Email Protection and Email Gateway Defense. Exemptions added in either interface apply to both products.

Only exempt senders you fully trust.

To exempt a sender:

In Email Protection, go to Policies.
In the left sidebar under Threats, click Machine learning exemptions.
In the Exemptions section, enter the email address you want to exempt.
Click Add.

Viewing Subscription Bomb Messages in the Email Log

Messages identified as subscription bomb attacks appear in the Email Log with the reason code Subscription Bomb. To see subscription bomb reason codes, filter the Email Log by Blocked status.

Go to the Email Log.
Use the All statuses dropdown filter and select Blocked.

Blocked messages show an action of Blocked in the log. Because blocked messages are rejected at SMTP and never stored, they cannot be previewed or released from the Email Log.

Best Practices

Review subscription bomb detections regularly to ensure legitimate burst senders (such as event registration services) are not being blocked.
Keep exemptions as specific as possible. Exempt individual email addresses rather than entire domains when possible.
Monitor the Email Log for subscription bomb reason codes to identify patterns and potential attacks.