What’s the difference between server-side and client-side filters?

Server-side filters run on the mailbox provider's machines. Client-side filters run on your device. That is the whole split. The interesting part is what each one can see, and where the junk actually ends up.

Server-side: where the real work happens

Gmail, Outlook.com, Yahoo, Apple iCloud, Fastmail, and every corporate Microsoft 365 or Google Workspace tenant filter on their own servers before anything lands in your inbox. By the time a message shows up in the Gmail web app, it has already been scored, classified, and routed.

These filters see things your laptop never will:

• Every other message hitting that provider from the same sending IP, in real time.
• Engagement signals across millions of users (opens, replies, deletes without reading, "this is spam" clicks, "not spam" clicks).
• Authentication results from SPF, DKIM, and DMARC, checked against the published policy in DNS.
• Connection-level data like reverse DNS, TLS version, and whether the sender follows RFC 5321 on the SMTP conversation.

That last point matters. A lot of filtering decisions happen during the SMTP handshake, before the message body is even accepted. For the timeline of when each check fires, see at what point is an email filtered and what happens during SMTP connection filtering.

The server decides: accept and inbox, accept and junk, accept and quarantine, defer with a 4xx, or reject with a 5xx. That decision is final from the sender's point of view. Your email client never sees the rejected stuff.

Client-side: rules and personal preferences

Client-side filters live in the app you read mail in. Outlook desktop, Apple Mail, Thunderbird, eM Client, and similar tools all ship with some form of local filtering.

They run after the message has already been delivered to your mailbox. How that delivery happens changes what client-side filters can do:

• With IMAP, the folders live on the server. If the server moved a message to Junk, your client sees it in Junk. Your client can move it back, and that move syncs upstream.
• With POP3, the client downloads messages and (usually) deletes them from the server. From that point on, the server has no idea what happened. Any filtering is purely local.
• With Exchange or Microsoft 365, server rules and client rules coexist. Server rules run for everyone on every device. Client rules only fire when Outlook desktop is open.

What client-side filters are actually good at:

• Sorting newsletters into a folder by sender domain.
• Flagging anything from your boss as high priority.
• Auto-filing receipts from Stripe into an Accounting folder.
• Bayesian junk detection on what you personally mark as spam (Thunderbird and Apple Mail both do this).

What they cannot do: see the global picture. Your Mac has no idea that the same sending IP just blasted 4 million people, and no idea what your neighbors clicked "report spam" on this morning.

The Junk folder confusion

When you see a message in Junk, you usually do not know which filter put it there. It could have been the server (a Gmail spam classification, an Outlook quarantine release that landed in Junk instead) or your local client (an Outlook rule, a Thunderbird Bayesian verdict). The folder name is the same. The mechanism is not.

This matters when you are debugging deliverability. A sender complaining that "my emails go to junk for this one recipient" might be hitting a local Outlook rule, not a Microsoft 365 tenant policy. Ask which folder, which client, and whether other recipients at the same domain see the same thing.

For the broader split between global provider decisions and per-user preferences, see global vs user-level filtering and junk folder vs spam folder.

What this means if you send email

As a sender, you are negotiating with server-side filters. They decide whether you reach the inbox at all. Client-side rules only matter once you have already cleared that bar, and they are recipient-specific so you cannot tune for them.

Focus your work on the things the server sees: authentication (SPF, DKIM, DMARC), sending IP and domain reputation, list quality, and engagement. Everything else is downstream of that.