Spam, senders you always allow, and files blocked for viruses

The mail server that receives your email checks every message for spam and viruses before Solstral sees it. Solstral goes by its answer.

Spam

An email marked as spam is kept, but it isn't put on any record, doesn't appear in the Inbox, doesn't start a flow and nobody is notified. Admins find it in the Inbox's Spam list for 30 days. Not spam puts it on its record and in the Inbox. It doesn't start flows after the fact, because a reply that sat in Spam for a day would act on old news.

Always let a sender through

On a message in Spam, Always allow… moves it to the Inbox and lets that address, or everyone at its domain, skip the spam check from now on, for the inbox the email was sent to. You can also add and remove senders in Settings ▸ Email ▸ Inboxes under Never treat as spam, for one inbox or every inbox.

This only applies to email that proves it came from that sender: it has to pass DMARC, the check that the sender's own domain sent it. Anyone can put any name in the From line, so without that check the list would let in whoever typed the right address. If a sender's domain has no DMARC record, their email still goes by the spam check; ask them to add one. A whole consumer domain such as gmail.com or outlook.com can't be allowed, because anyone can have an address there; allow the person's address instead.

Files with a virus

When the mail server finds a virus, the email itself is kept and its attachments are set aside. Each one shows on the record as blocked: malware found and can't be opened or downloaded, a note on the record says what happened, and your admins are told. Being on the allow-list never changes this. Files set aside are deleted after 30 days.