Ingest protection

When email arrives, ddx PMO runs it through the classifier — the step that reads a message and files what it finds into the right registers. Classifying costs money (it uses an AI model), so a runaway or hostile sender could rack up spend or flood your project. This page caps that.

It’s an org-admin page: by default anyone on the team can view it, but only an org admin can change the settings or add policies.

How a message is checked

Every inbound email passes through a gate before it’s classified. The checks run in order, and the first one that matches decides the outcome:

1. Global brake on — held.
2. Trusted sender on a DMARC-verified message — allowed straight through.
3. Sender or domain already paused — held.
4. Gibberish sender address (looks auto-generated) — held, and the sender is paused.
5. Too many emails this hour from one sender, or too many different senders this hour from one company domain — held, and that sender or domain is paused.
6. Daily budget used up for that sender — held until the spend resets the next day.

Anything that isn’t held is classified as normal. A message with no readable sender address can’t be rated or budgeted, so it’s allowed through at this gate.

Held mail is never dropped

When the gate holds a message it’s stored, not deleted (see Held mail). Most holds release automatically once the reason clears — the hourly window passes, the daily budget resets, or you un-pause the sender. A held message also shows up in the project inbox, where you can open it and choose Classify anyway to override the hold for that one item.

Note

Messages held as gibberish sender are the exception: they don’t auto-release. Clear them by un-pausing the sender here, or by Classify anyway on the item.

The settings

These apply to the whole organisation:

Setting	What it does
Default daily budget (per sender)	Dollar cap on classifier spend per sender, per day. A sender or domain policy can override it.
Rate limit (emails / hour / sender)	How many emails one sender can have classified in an hour before the rest are held.
Domain burst	How many different senders one company domain can have in an hour — a flood of distinct senders from one domain is a sign of fake addresses. Free mail providers (Gmail, Outlook, etc.) are exempt.
Max attachments classified / email	How many attachments on a single email get classified. Any beyond the limit are skipped (not held); you can reclassify the item later if needed.
Gibberish sender local-part	Whether to hold for review addresses that look auto-generated, or allow them without the check.

Global classification brake

The big switch at the top. Turn it on and every new item is held — nothing is classified — until you turn it off. Use it to stop spend immediately if something is going wrong; held items release once you switch it back off.

Sender and domain policies

Below the settings you can add overrides for a specific email address or a whole domain. A policy can:

• Raise (or lower) the daily budget for that sender or domain.
• Trust it, so its mail skips the limits — but only on a message that passes DMARC email authentication, so a spoofer can’t claim a trusted address.
• Be paused. The gate pauses a sender automatically when they trip a rate or gibberish check, and pauses a domain when it trips the burst check; paused policies are listed first, with an Un-pause button.